topic ISE 3.2 EAP-TLS Azure AD permission error in Network Access Control

ISE 3.2 EAP-TLS Azure AD permission error

seankin — Wed, 23 Nov 2022 15:21:45 GMT

We are implementing Azure AD EAP-TLS authentication on ISE 3.2 using the following guide:

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/218197-configure-ise-3-2-eap-tls-with-azure-act.html

We have hit an issue where in the rest-id-store.log we are getting the following error (Insufficient privileges to complete the operation):

,799 ERROR [http-nio-9601-exec-5][[]] cisco.ise.ropc.utilities.RestUtility -::::- Error response in 'GET' request. Status - '403'. Error - '{"error":{"code":"Authorization_RequestDenied","message":"Insufficient privileges to complete the operation

In the ISE 3.2 demonstration video, the same error occurs and the presentor is unable to get it working (Time 29.40) and does not provide any resolution:

https://www.youtube.com/watch?v=857hIkxkEAU

Has anyone managed to get this working and solve the 403 permission error or does EAP-TLS on 3.2 not work?

Re: ISE 3.2 EAP-TLS Azure AD permission error

thomas — Wed, 23 Nov 2022 16:06:12 GMT

Yes, I included the solution in the Show Notes of that YouTube video 8-)

💡The permissions problem in the demo was 1 additional API Permission in Azure Active Directory was required to make it work. The 3 required permissions are
- Group.Read.All
- User.Read
- User.Read.All ◁◁◁ This was missing!

Re: ISE 3.2 EAP-TLS Azure AD permission error

seankin — Wed, 23 Nov 2022 16:07:59 GMT

Brilliant! Thank you 🙂

Re: ISE 3.2 EAP-TLS Azure AD permission error

Jan Junker — Thu, 16 Mar 2023 14:30:10 GMT

Hi there. This is EAP-TLS with Azure AD users. Would this also work with Azure AD computer accounts as well?

Re: ISE 3.2 EAP-TLS Azure AD permission error

Greg Gibbs — Thu, 16 Mar 2023 21:04:43 GMT

There is no such thing as an Azure AD 'Computer' account. See this document for more information.

Cisco ISE with Microsoft Active Directory, Azure AD, and Intune