Question

A security engineer wants Windows domain laptops to prove BOTH the machine's and the logged-in user's identity in a single EAP conversation, so that authorization can grant full access only when a corporate machine AND a valid domain user are authenticated together. Which authentication method should be configured in the ISE Allowed Protocols policy to achieve this?

Accepted Answer

TEAP with EAP chaining, referencing both machine and user authentication results in the authorization policy

Answer

PEAP with MSCHAPv2 and the 'Retrieve group membership from AD' option enabled

Answer

EAP-TLS with a single client certificate and machine authentication only

Answer

EAP-FAST with anonymous PAC provisioning and MAB fallback enabled