No, they can still refuse to provide a device as my original comment states. Since my employer refused to do so, they came up with an alternative without any additional input from me. They completely side stepped the app requirement by using a little key chain once they reached out to Cisco.