Question

An ISE administrator has successfully joined ISE to an Active Directory domain and can authenticate domain users. However, when building an authorization policy, the administrator cannot select any AD security groups from the external group dropdown, and the condition list is empty. Authentication against AD works correctly. What must the administrator do to make AD groups available for use in authorization conditions?

Accepted Answer

Retrieve the desired groups from the AD join point's Groups tab so they are added to ISE and become available in policy conditions

Answer

Enable the Machine Access Restriction (MAR) feature on the AD join point to expose group membership

Answer

Create an Identity Source Sequence that includes the AD join point before groups can be referenced

Answer

Change the AD join point's authentication protocol to EAP-TLS so certificate groups are populated