Differentiate BYOD for AD users vs Internal users

[omadrile]

Hi team,

After a guest user completing the self registering process and then an ISE admin user manually creating an Internal ISE db user with the same guest user credentials, I understand it's possible to go through the BYOD flow for those Internal users right? Now, assuming ISE has an external identity store i.e. Active Directory, and those AD users go through the BYOD flow as well. A way to differentiate both users could be using the Common Name as the certificate attribute and then checking whether the username belongs to a specific AD group or Internal User db... do you see any potential issue why this approach might not work? Any input would be appreciated, thanks!

[Sathiyanarayanan Ravindran]

Hi Omadrile,

As far as I know, You can play with the policies and Identity source sequence to fix this. Use the unique attributes for creating the policies.