Contoso allows users to access SharePoint Online and Exchange Online from any device. Security requires that when users sign in from unmanaged (non-compliant, non-Hybrid-joined) devices, they must NOT be able to download, print, or sync files from SharePoint Online, but should still be able to view documents in the browser. On managed devices, full access should remain unrestricted. Which Conditional Access session control should you configure to meet this requirement?