Contoso purchases 200 new corporate iPhones through an authorized Apple reseller. The endpoint administrator wants these devices to enroll in Intune automatically during the initial setup (out-of-box experience), be marked as supervised, and prevent users from removing the management profile. Which combination must the administrator configure before the devices are distributed?