In Cisco ISE version 2.1 for BYOD with a Single SSID setup, 802.1x must be configured to provide the necessary layer of security and to facilitate the device registration process. 802.1x authentication allows for the use of EAP (Extensible Authentication Protocol) to authenticate users before they can access the network.
This ensures that only authorized devices can join the BYOD network, providing a secure method for device onboarding and access control. References: CCNP Enterprise Wireless Design ENWLSD 300-425 and Implementation ENWLSI 300-430 Official Cert Guide