which applications a user can install and run on a company issued mobile device?

Which of the following technical controls is BEST used to define which applications a user can
install and run on a company issued mobile device?

A.
Authentication

B.
Blacklisting