Access policy for MyDevices Portal

[vigogne]

Tell me please. Is it is possible to create an access policy for the MyDevices portal to allow access only to a certain group in AD?
At the moment, I have done this way:

In the Identity Source Sequences at MyDevice_Portal_Sequence I left "Internal Users" Identity Source only. Then I added the Network Access User with the same name as in the AD Database and password type as AD Sequence.

It works, but it is very inconvenient and not flexible.

And second question. How can I modify MyDevices Portal for add in standard form combo-box with selecting endpoint group?

[Damien Miller · Accepted solution]

Unfortunately you have stumbled upon an area that has frustrated many. As you found, the RBAC for the My devices portal is non existent, you map AD then everyone has access. This certainly is not an ideal situation for the vast majority of use cases. Compounding the issue, the portal is tied to a specific endpoint ID group, you need a portal per ID group you want to add endpoints in to. Due to this, it's almost always better to build an external portal leveraging the ERS APIs so you can do RBAC and endpoint ID group selction. 

If a portal per identity group doesn't deter you, then you can look at Craig's old guide on adding RBAC to the my devices portal. Craig's document is old, and full of 1.3 screenshots, so it looks different, but it's all still valid. 
https://community.cisco.com/t5/security-documents/ise-sponsor-amp-my-devices-authorization-on-secondary-attributes/ta-p/3641379

[vigogne]

Thanks a lot for your answer. It is regrettable to hear about such shortcomings in a program created for precisely these purposes.

But how about my second question? Can I customize the Mydevice Portal for adding combo-box with select a Endpoint Identity Group?

[Damien Miller · Accepted solution]

It is not possible to add an identity group selection to the built in my devices portal, you need a unique portal per ID group. 

[vigogne]

Weird flex, but ok )