A user calls the help desk reporting that a personal tablet they previously onboarded through BYOD has been lost. The security team wants the user to be able to immediately prevent that specific device from accessing the network without waiting for an administrator, while other registered devices belonging to that same user continue working normally. Which ISE capability should the user be directed to use?