To reduce costs, an organization, has decided it will no longer support corporate phones. All employees must use a BYOD device to access the company's collaboration services, which are cloud hosted…

Iris scan biometrics require specialized hardware not universally present on BYOD devices, and this combination does not address app-level data containment or the no-local-storage requirement.

Mobile Application Management (MAM) enforces corporate data policies - such as preventing downloads to local storage and protecting cached data - at the application layer without requiring a device-level agent, satisfying the no-agent requirement. Geofencing restricts cloud service access to approved geographic locations, reinforcing the cloud forward proxy access control. MFA fulfills the strong authentication requirement, and together these controls address all six listed requirements without full device enrollment.

VPN and device management both require agents to be deployed to end-user devices, directly violating the stated requirement that no agents be installed.

MDM requires deploying a management agent or profile to the device for full enrollment, which contradicts the end user computing department's explicit requirement to avoid agent deployment.