Your network contains an Active Directory domain named contoso.com. The domain
contains servers named Server1 and Server2 that run Windows Server 2012 R2. Server1
has the Active Directory Federation Services server role installed. Server2 is a file server.
Your company introduces a Bring Your Own Device (BYOD) policy.
You need to ensure that users can use a personal device to access domain resources by
using Single Sign-On (SSO) while they are connected to the internal network.
Which two actions should you perform? (Each correct answer presents part of the solution.
Choose two.)
A.
Enable the Device Registration Service in Active Directory.
B.
Publish the Device Registration Service by using a Web Application Proxy.
C.
Configure Active Directory Federation Services (AD FS) for the Device Registration
Service.
D.
Install the Work Folders role service on Server2.
E.
Create and configure a sync share on Server2.
Answer A and C are correct
https://technet.microsoft.com/en-us/library/dn486831.aspx
You can enable Device Registration Service (DRS) on your federation server after you complete the procedures in Step 4: Configure a Federation Server. The Device Registration Service provides an onboarding mechanism for seamless second factor authentication, persistent single sign-on (SSO), and conditional access to consumers that require access to company resources. For more information about DRS, see Join to Workplace from Any Device for SSO and Seamless Second Factor Authentication Across Company Applications