Which two Workspace ONE configurations can prevent email access from unmanaged devices? (Choose two.)

A company has an organization group which is used only to register devices for executives. The administrator has noticed that employees are using that Group ID to register their own devices without authorization.
How can the administrator prevent future registrations into this organization group?

What process allows an administrator to prepare 500 newly purchased Windows 10 devices for Workspace ONE enrollment without joining the devices to the organization's Active Directory (AD) domain or using Azure AD?

Migrating the first Microsoft Active Directory (AD) Group Policy Object (GPO) into Workspace ONE requires which configuration?

Which default attribute is used as a unique identifier for directory accounts in Workspace One Access?