Remote logs aid incident review but do not encrypt sensitive files on a stolen, powered-down drive.

An attacker with physical access may bypass the installed operating system and read unencrypted sectors directly.

Prompt formatting is a user-interface preference and offers no protection against offline storage analysis.

Corporate ownership models are not equivalent to BYOD. Reclassifying personal handsets does not establish meaningful employee consent for management actions.

Enrollment technology implements controls, but it does not replace advance notice of what personal information remains outside administrative scope or how work data is removed.

Encrypted email transport is necessary but unrelated to employee expectations about handset privacy, administrative monitoring, or data separation during departure.

Guest access has no device ownership or managed lifecycle guarantee and cannot describe the controlled fleet.

BYOD assumes the employee owns the handset, contrary to the organization's stated ownership of the fleet.

Employee ownership would change policy and privacy boundaries, whereas COPE explicitly describes company-owned handsets with personal use.

Procurement terms alone do not define the permitted personal use and administrative control boundary in the scenario.

Enrollment alone does not guarantee that the device remains patched or compliant after future changes.

Images are stale and manipulable; they cannot provide automated enforcement on every access decision.

Enrollment confirms management registration, not that the mobile OS meets the currently required patch or device-integrity baseline.

DNS suffix settings affect name resolution, not inter-application content-sharing permissions on the handset.

A VPN can protect network traffic, but it cannot by itself prevent managed content from being pasted or opened locally in an unmanaged mobile application.

Email DLP can inspect messages that traverse the enterprise mail gateway, but it does not govern local copies from a managed app into personal messaging tools.

Platform privilege changes do not inherently bind login challenges to an origin-resistant authenticator.

A rooted handset can typically continue using radios; the relevant concern is altered security boundaries.

Modified devices may lose reliable vendor updates; root access is not a patch-compliance guarantee.

Wi-Fi authentication does not repair local operating-system integrity or constrain unsigned code execution.

Personal consent to modification does not remove business risk from access to protected corporate applications.

Exposing credentials increases risk and does not address the compromised endpoint trust assumptions.

Broad administrator delegation can grant dangerous control to untrusted applications.

Allowing unrestricted sideloading expands the path for unreviewed packages and evades the intended distribution policy.

Signature checking helps confirm package provenance and integrity, so disabling it weakens software supply-chain controls.

Persistent unlock leaves data exposed if an attacker acquires the device during a normal workday.

Plaintext storage makes offline attacks easier even when a user interface still requires a passcode.

Remote commands can be useful once a lost device reconnects, but they cannot replace encryption protecting locally stored data against immediate offline access.

A consumer folder is not the OS-backed work-profile boundary needed for selective app and data administration.

Unlocking the bootloader facilitates firmware modification and does not provide a protected enterprise work-data container.

Removing sandbox isolation would reduce privacy and separation rather than produce a managed work environment.

Apple supervision applies to its platforms and cannot provide the Android work profile described for Android BYOD.

The HTTPS certificate secures the direct management connection, but renewing it alone does not restore Apple push notifications when the push-service certificate has expired.

An EAP-TLS certificate can affect enterprise Wi-Fi authentication, but the scenario says devices have network access and specifically describes failed management notification delivery.

An identity provider signing certificate affects SSO assertions, not the Apple push channel used to prompt devices to contact MDM after enrollment.