A company has an on-premises Exchange 2013 environment. You enable Microsoft Exchange ActiveSync.
All users in the sales department have Windows Phone devices and Surface Pro devices.
Current ActiveSync policies do not block Sales users from creating company email profiles on their Windows Phone devices.
You need to implement Exchange ActiveSync conditional access.
What should you do?