how does endpoint identity group assignment work in cisco ISE

[SMD28316]

If a guest user successfully registered with guest portal, shouldn't it transfer to "guestendpoints identity group" as a result?

For all guest users, I can see that it's in the "profiled" identity group when it hits on guest redirection policy, upon change of authorization, why doesn't it get changed to "Guest endpoint" identity group? as a result it never hits on "guest_access" policy that matches against "Guest endpoint identity group" and users get stuck in guest redirection loop.

If I try to manually change it to "Guest endpoint" identity group redirection won't happen, shouldn't ISE change Identity group dynamically?

[Marcelo Morais · Accepted solution]

Hi @SMD28316 ,

 credentialed Guest Portal (Work Centers > Guest Access > Portals & Components > Guest Portals) will assign the Guest Endpoint to the Endpoint Identity Group for Guest Device Registration (Work Centers > Guest Access > Portals & Components > Guest Types

please check this configuration.

Hope this helps !!!