Group mapping feature

[user1024]

Is it possible to do group mapping in ISE? I was able to do this in ACS and map an external AD group to an identity group when creating an access policy. Which would allow me to create a single authorization policy that would affect both internal and external users. I guess the terminologies might be different but I haven't been able to find anything to point me in the right direction.

[Cory Peterson]

With the use of OR in the policy conditions you can still do this just in a little bit different way. 

What version of ISE are you running? The policy is a bit different between 2.2 and 2.3.

[Francesco Molino]

Hi

Yes you can do 1 rule in the authorization part. On your condition, you say AD Group OR ISE Identity group.

Let me know if you need more assistance in creating the rule.