It seems that the account you used to log into the switch doesn't have permissions to higher its privilege level. If you are using ISE as the TACACS server then I think you can workaround this by creating a new network access user in ISE with enable password configured, and then you create an authentication rule on ISE with TACACS service equals to enable, and finally you point that authentication rule to ISE internal users database.
When you log into the switch with these new user credentials, and you type "en" you should then use the new enable password you configured in ISE, that should work.
Alternatively, but depending on your TACACS configs on the switch, you simulate a link failure between the switch and ISE, maybe by placing a deny all firewall rule between the switch and ISE if the firewall happens to be in the path, and if your TACACS configs applied to the switch are configured to fall back to local or if "if-authenticated" keyword is configured, then authorizing the enable command would be skipped.
