CIsco ISE 802.1x EAP-TLS authentication with Entra ID

[cuiL]

Our customer exisitng environment all PC join to entra id and no any infra in on-premise

Now. they would like to implement new Wi-FI with kind of this solutions but it's look like very new for us and less experience

Therefore, may I asking in this community that anyone have experience to implement this solution on production.

Also, with this is any concern point or this solutions is good idea to go with it?

[hs08]

When we use certificate based authentication, can we compare the Subject Name in the certificate to the Entra ID Group? I mean even the device already have valid certificate but the user not in member of Entra ID the user will be denied.

[MSJ1]

Hi @Greg Gibbs 

Is there a manual or reference that shows what are the options I need to enable in External Identity Store - REST ID if I want to test EAP-TLS authentication for Entra ID Devices not users ? trying to test with Device Name Condition.

Also In REST External Identity Store Groups tab - If I am looking for Device Group it should show up here once created in Entra ID ? Simple question is if Device group and user group will show up here in Groups tab  ? 

[Greg Gibbs]

The steps are in the Admin Guide which is also linked in my post - https://www.cisco.com/c/en/us/td/docs/security/ise/3-5/admin_guide/b_ise_admin_3_5/b_ISE_admin_asset_visibility.html#task_hbc_rwl_qtb