Cisco ISE Guest account Account duration discrepancy

[mlaurencik]

Hello experts !

We use Cisco ISE for guest provisioning and our customer reported interesting issue. For a specific Guest account type, we have set the account "Maximum account duration" to 30 days, counted "From first login", however when sponsor generates a guest account, the email received by the guest displays: "Time left: 14 days".   "Valid To: 30 days From First Login", however the Sponsor Admin portal says: "Time left: 14 days". Guest Account Purge Policy is set to Every 15 days. Am I missing anything here, please?

Cisco ISE 2.6.0.156  patch 9,10

[Janne K.]

what does it say in the sponsor administration portal? is it also 14 days there?

try to look under Work center->guest access->settings->guest account purge policy.
as soon as the account gets activated it should display the correct time

[mlaurencik]

Hello Janne, I checked what you asked for and corrected my problem description. IT is the Sponsor portal where we see 14 days vs, guest's email showing 30 days. Guest purge policy is set to 15 days. Still, I don't see a clear the logic here. thanks.

[Janne K.]

What happens when you activate/use the guest account? Does it still display the wrong time?

I'm not sure how it looks in ver 2.6 but under Work center->guest access->settings->guest account purge policy
you should see something in the line of "Expire portal-user information after: xxx days"

[mlaurencik · Accepted solution]

This seems to be the explanation. Until the account is activated, the "Time left" in the Sponsor Admin Portal does show a value representing a time of non-activated account until it will be purged. The expiration time is set under Work center->Guest access->Settings->Guest account purge policy-> "Expire portal-user information after:"

Once the account is activated, the "Time left" value represents the "real" remaining time until an active account expires.