Water-utility contractors bring personal Android phones that need city email without IT owning the personal OS. Which enrollment path should the administrator enable?
Select an answer to reveal the explanation.
Short Explanation
Personal phones are like a contractor’s own truck with a city toolbox in the bed—you manage the toolbox, not the whole truck. A work profile or container keeps mail in the work side without fully managing the personal OS. Full-device wipe and NSX groups are the wrong ownership model.
Full Explanation
Water-utility contractors bring personal Android phones that need city email without IT owning the personal OS. Enable a BYOD work-profile or container enrollment so work apps stay isolated from personal data—a city toolbox in the contractor’s truck, not ownership of the whole truck. Fully managing each personal device as corporate-owned so the entire OS can be wiped fails by concept because full-device wipe ownership is the wrong model for personally owned contractor phones. Deploying only a Carbon Black Cloud sensor and skipping Workspace ONE UEM enrollment fails because CBC is not MDM email containerization on Android BYOD. Joining each phone to an NSX-T identity firewall group as a substitute for MDM fails because NSX groups do not create Android work profiles or deliver work email under BYOD privacy constraints. Exam caveat: contractor personal Android with work email uses BYOD work-profile/container enrollment—not COPE full wipe, not CBC-only, not NSX IDFW-as-MDM. Operational check: enroll a personal Android with work profile, confirm work email lands in the work container, confirm personal data remains outside IT wipe scope per policy, and reject full-device corporate management for that population. Publish privacy notices to contractors explaining work-profile boundaries before enrollment day.