No, they can still refuse to provide a device as my original comment states. Since my employer refused to do so, they came up with an alternative without any additional input from me. They completely side stepped the app requirement by using a little key chain once they reached out to Cisco. Your employer has options. They have to find out what works best to make sure you can do the job they have hired you to do.