Cisco ISE 3.3 with AZURE AD/ Intune

[Leonardo Santana]

Hi,

Our customer wants to integrate Cisco ISE with Azure AD, and they want to use AutoPilot to autoprovision the computers. But how can we authenticate and authorize a computer that dont have anything?

If we integrate with Intune this will work?

Enviroment:

Two nodes ISE 3.3 Patch 2

Regards

[dalbanil]

Hello Leonardo, if you are going to authenticate Laptops that don't have absolutely anything of configuration and don't have credentials to present/supplicant configured, I would recommend you to configure on ISE a policy set that catches all the authentication attempts from the SSIDs/Switches that these laptops are connected to via MAB, and push an ACL so the endpoints only get access to the Domain controllers or the servers that you use to provision them. Once they are able to present their credentials or certificate with the help of a supplicant, you can authenticate them using an external identity source like Azure AD, 

Here you have an example of EAP TLS authentication using Azure: 

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/218197-configure-ise-3-2-eap-tls-with-azure-act.html

Regarding the intune integration, as long as ISE can validate that the devices are compliant in Intune, you could use this in your authorization policies for the devices that are allowed to connect without a supplicant configured.

https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/217290-integrate-intune-mdm-with-identity-servi.html

[Leonardo Santana]

Hi Dalbanil,

Thanks for you answer.

The integration with Intune will allow to create rules based on the device registered at the Intune? Because our customer
wants to deploy auto pilot for the computers. When arrive a new computer it doesnt have the certificate and GPO to ISE allow thisdevice to enter in the network? The intune integration will solve this question?

[Greg Gibbs]

@Leonardo Santana, the AutoPilot registration and Intune registration are separate things. When an AutoPilot registered device is received by a user, they would need to connect it to the network to complete the build/installation. This would require network connectivity to internet-based systems like Entra ID and Intune.

In this initial phase, the device would have no certificate and would not yet be enrolled with Intune, so ISE would have nothing to use for authentication and nothing to identify it as a Corporate-owned device. You would likely need to look at options like the following for this initial connectivity.

• Connecting to a non-802.1x Wifi network (like PSK, hotspot, etc) with basic internet connectivity to complete the initial build and enrolment/registration with Intune
• Connecting to a dedicated build Wired network (ideally with physical security) that provides basic internet connectivity
• Capturing the MAC address of the device, adding it to an 'AllowList' Endpoint Identity Group, and having a Wired MAB policy that would permit it limited access to an internet proxy or some other segmented network access. This could be done using manual GUI configuration or APIs, but would still add operational overhead.

Once the Intune enrolment is complete and the device has a certificate enrolled with the GUID, the user could connect to the secure Wired/Wireless corporate networks.

Ideally, MS would add some method to connect to an 802.1x secured network during the initial stages, but they never even implemented that in traditional builds using SCCM, so I won't hold my breath for that.

[Leonardo Santana]

Hi Greg thanks for your answer. Its was very valuable to me.

I´ll these option for the initial connectivity.

Intune is for posture purposes right?

[Greg Gibbs]

@Leonardo Santana... yes, the Intune integration with ISE would be used to perform Intune MDM registration/compliance checks against the device/user sessions as a condition for Authorization.

For more information, you might be interested in the webinar I delivered on ISE Integration with Intune MDM