Thank you for the detailed explanation and for sharing your blog post — it was very helpful.
I understand your point about matching the exact value present in the certificate, including the full DNS Name= string, and using a regex such as:
^DNS Name=([a-zA-Z0-9-]+).netz.tuev-nord.de
After updating the regex accordingly, I can confirm that the validation succeeds and the previous errors are gone. So from a matching perspective, the regex itself is now working as expected.
However, in my case the remaining challenge is that the device name in Entra ID is stored without the FQDN (for example, DeviceName), while the certificate SAN contains the full FQDN (DeviceName.netz.tuev-nord.de). Even though the regex matches successfully, ISE still forwards the full FQDN to Entra ID, which results in no device match on the Entra side.
From my testing, it appears that the current Azure / Entra Device Query implementation in ISE uses regex only for validation/matching, and does not support extracting or using a capture group (such as just the hostname) as the device identity.
Do you know if using capture groups to retrieve only the device name is something that is planned or being considered for a future ISE release? This would be very helpful in environments where certificate identities and Entra device naming conventions don’t fully align.
Thanks again for your time and for the insights you’ve already shared.
