Can ISE using Azure MFA with Internal User on ISE for authorize only

[jewfcb001]

Hi All ,

I try to find the solution of Anyconnect integrate with Azure AD and ISE do authorize only . This is solution working fine but ISE integrate with on-premise AD for do condition authorization and If I need use group internal user for do authorization . Can I do that ? 

Reference : https://www.packetswitch.co.uk/cisco-anyconnect-with-azure-ad/

      https://community.cisco.com/t5/network-access-control/ise-using-azure-mfa-and-ad/td-p/3592900

[balaji.bandi]

trying to understand your scenario, you looking authentication with Local ISE and Authorisation send to Azure AD ?

please clarify ?

[jewfcb001]

@balaji.bandi 

I looking for authentication with Azure AD and authorization check from group of internal user for do authorization policy . I'm not sure I explain clear or not?

[balaji.bandi]

ok how is your Azure and on Prem AD synched you have any agent ?

is the users are different on prem and azure cloud ?

if you have synched user and groups to Azure AD - then ISE can use that AD group for authentication and Authorisation, what is the challange you see here ?

[jewfcb001]

@balaji.bandi 

 I understand If I sync ISE with  on prem AD and AD replicate  with Azure AD can do  that .

My scenario If I will not sync user from AD group. Can I manual create same user with AD in local user in ISE . Can i do that ? 

[balaji.bandi]

If the users and groups are not synched ? how do you validate the user belong to group which is not there ?

Can I manual create same user with AD in local user in ISE . Can i do that ?  - If you create local user in ISE, the users will be Local users - they are not AD users right. - if you looking to authenticate and authz with that database sure you can do so.

personally your use case not valid. AD user should be located in AD, and belong to Group that is exist to the condition matches here.

[jewfcb001]

@balaji.bandi 

Thank you for answer. I see in your answer but the customer have some restriction.

I looking authentication with Azure AD and condition of authorization I will using the group local  user and user in ISE. 

[balaji.bandi]

I do see any option you looking 2 different system - as per i know Either you can use local or Azure AD  for Authentication and Authorization

[jewfcb001]

@balaji.bandi 

I will try to Azure AD for anyconnect authentication first and ISE do authorize with internal local user. 

I think , I will test first .

[balaji.bandi]

If you also looking 2facto authentication - Like to take advantage of  SAML MS authenticator with Azure AD.

[jewfcb001]

@balaji.bandi 

Yes I looking for 2FA . Now I integrate SAML with Azure AD  And after authentication I need ISE do authorize but in condition on ISE I need the local user group in ISE for do that . that's all my requirement.

I'm not sure Are you got my point ?  

[Marius Gunnerud]

You can create a local user in ISE and have the user use that for authentication, but this user will not be associated in any way with Active Directory.

[jewfcb001]

@Marius Gunnerud 

can create a local user in ISE . you mean authentication i can go Azure AD first and authorization i can go to ISE and check group and user on ISE .  My understand correct? If correct , It's my objective.

[Marius Gunnerud]

No, that is not what I meant.  you need to either use an external user or an internal user.  If you are using an external user but want to match on something other than an Active Directory group or similar, you would need to install a posture agent on the client machine and then match on something local on the machine that the agent can identify.

Matching on a user group local to the ISE is not possible as far as I know.  There is no way to associate an external user with a local group that I can see.

[jewfcb001]

As Picture below It's my objective. I understand It's my sense but restrictions from the customer.