Contoso allows employees to use their personal Windows 11 laptops to access Microsoft 365 email and SharePoint. The security team requires these personal devices to appear in Microsoft Entra ID so Conditional Access can evaluate them, but the company must NOT take full management ownership of the personal machines or place them under a corporate account sign-in. Which device identity option should you instruct users to configure?