Question

A network administrator has joined Cisco ISE to a native Active Directory domain and wants to create an authorization rule that grants elevated access only to users whose AD account has the 'department' attribute set to 'Engineering'. The administrator has already retrieved AD groups but the department attribute is not available for selection when building the authorization condition. What must the administrator do to use this attribute in the policy?

Accepted Answer

Add the 'department' attribute to the ISE Active Directory join point's Attributes tab so it can be referenced as an AD dictionary attribute in the authorization condition

Answer

Create a separate LDAP identity store pointing to the same domain controllers because native AD does not support attribute-based conditions

Answer

Enable the 'department' attribute under the Endpoint Identity Group settings so ISE can profile the user object

Answer

Configure an internal user attribute named 'department' and map it manually to each AD user during authentication