Question

A network administrator is deploying BYOD onboarding with the ISE internal CA. Corporate policy requires that only endpoints already listed in a specific ISE endpoint identity group be permitted to complete certificate provisioning, while all other personal devices are silently denied enrollment. Which ISE configuration approach best enforces this allow-list requirement during the BYOD flow?

Accepted Answer

Create an authorization rule that matches the pre-approved endpoint identity group before the BYOD provisioning rule, and deny access for endpoints that do not match

Answer

Enable the Blocked List endpoint identity group and add all unapproved MAC addresses to it manually

Answer

Configure the native supplicant profile to reject certificates issued to devices not in Active Directory

Answer

Set the internal CA certificate template lifetime to zero for all non-corporate endpoints