I have Cisco ISE integrated with Microsoft Intune and the Meraki platform. Our iPad deployment process works as follows:
- iPads are initially enrolled using an enrollment SSID.
- During enrollment, the devices communicate with Intune and receive the required configuration profiles and SCEP certificates.
- Once enrollment is complete, they automatically switch to our secure SSID and authenticate using the SCEP certificate.
Recently, I've been experiencing an issue with iPads that have been disconnected from our network for an extended period and were automatically removed by the Intune device cleanup rule.
After re-enrolling these iPads, they successfully receive all required profiles and certificates. However, they are no longer able to connect to the secure SSID.
When reviewing the Cisco ISE logs, I can see that authentication succeeds using the SCEP certificate. The failure occurs during the authorization phase. My authorization policy checks two conditions:
- The device is registered in Intune.
and
- The device is compliant.
The logs indicate that ISE determines the device is not present in Intune, so authorization fails and the connection is denied.
To troubleshoot, I manually queried Microsoft Graph for one of the affected devices. The Graph response appears correct and contains the expected MDM attributes, including the new Intune device ID and Microsoft Entra ID device ID. ISE also correctly extracts the device ID from the SCEP certificate, and the device ID shown in the ISE authentication logs matches the device ID in both Intune and Microsoft Entra ID.
Despite this, ISE still reports that the device does not exist in Intune during authorization, as if it is unable to correctly interpret the Microsoft Graph response.
For reference:
- Cisco ISE is configured to purge stale endpoints after 30 days (ENDPOINTPURGE: ElapsedDays GREATERTHAN 30).
- Intune is configured with a 120-day device cleanup rule.
The following scenarios work as expected:
- Brand-new iPad enrollments.
- Re-enrollment of iPads that still exist in Intune.
The issue only affects iPads that were deleted by the Intune cleanup rule and then re-enrolled.
As part of my troubleshooting, I have:
- Cleared the endpoint history in Cisco ISE multiple times.
- Deleted the affected devices from both Intune and Microsoft Entra ID.
- Re-enrolled the devices from scratch.
Unfortunately, none of these steps have resolved the issue.
At this point, I'm running out of ideas and suspect there may be some stale mapping or synchronization issue between Cisco ISE and Microsoft Graph that is not immediately visible.
Has anyone encountered a similar issue or have any suggestions on what else I should investigate? Any advice would be greatly appreciated.
