Which Cisco ISE feature can differentiate a corporate endpoint from a personal device?

Which Cisco ISE feature can differentiate a corporate endpoint from a personal device?

A.
EAP chaining

B.
PAC files

C.
authenticated in-band provisioning

D.
machine authentication