Your customer has previously been using a container i zed solution on Device Administrator, and they are planning their migration to Android Enterprise. One of the customer requirements, coming from their IT team, is to set and enforce a security challenge for their BYOD users within the work profile that is separate and has different requirements from the device security challenges. Taking into account this requirement, what would you recommend?

Android 7.0 (Nougat) introduced the "Work Profile security challenge" feature, allowing administrators to enforce a separate, distinct lock screen for the work profile that can have different password requirements than the device's personal lock screen. This directly addresses the customer's requirement for a separate security challenge for BYOD users within the work profile. Devices running Android 6.0 and earlier do not support this feature, meaning a single device-wide security challenge would apply to both personal and work data. Fully managed devices with a work profile are not relevant here, as the question specifically concerns BYOD (work profile on personally-owned devices).