You want to restrict who can sign in to a managed device during working hours.

Device off hours: This setting allows you to specify times when the device cannot be used, effectively restricting access to certain hours.

Family Link accounts: Family Link is a parental control app that allows you to manage a child's account and device usage. By requiring Family Link accounts, you can enforce sign-in restrictions for younger users.

Other options are incorrect because:

A: Single sign-on (SSO) redirection simplifies sign-in for authorized users, but doesn't inherently restrict access.

C: User Data (Ephemeral) controls whether user data is saved locally, but doesn't restrict sign-in.