You are configuring a Cisco WLC (AireOS) to support single-SSID BYOD onboarding with ISE using the internal CA. Wireless users authenticate via 802.1X, then ISE returns a URL redirect authorization result to send new devices to the BYOD portal for native supplicant provisioning. During testing, ISE never sends the CoA and the client is never redirected to the portal even though the authorization policy matches. Which WLAN setting on the WLC must be enabled for the redirect and CoA to function?