iPads Authorization fail on ISE

[cghaderpour]

I have Cisco ISE integrated with Microsoft Intune and the Meraki platform. Our iPad deployment process works as follows:

• iPads are initially enrolled using an enrollment SSID.
• During enrollment, the devices communicate with Intune and receive the required configuration profiles and SCEP certificates.
• Once enrollment is complete, they automatically switch to our secure SSID and authenticate using the SCEP certificate.

Recently, I've been experiencing an issue with iPads that have been disconnected from our network for an extended period and were automatically removed by the Intune device cleanup rule.

After re-enrolling these iPads, they successfully receive all required profiles and certificates. However, they are no longer able to connect to the secure SSID.

When reviewing the Cisco ISE logs, I can see that authentication succeeds using the SCEP certificate. The failure occurs during the authorization phase. My authorization policy checks two conditions:

1. The device is registered in Intune.

and

1. The device is compliant.

The logs indicate that ISE determines the device is not present in Intune, so authorization fails and the connection is denied.

To troubleshoot, I manually queried Microsoft Graph for one of the affected devices. The Graph response appears correct and contains the expected MDM attributes, including the new Intune device ID and Microsoft Entra ID device ID. ISE also correctly extracts the device ID from the SCEP certificate, and the device ID shown in the ISE authentication logs matches the device ID in both Intune and Microsoft Entra ID.

Despite this, ISE still reports that the device does not exist in Intune during authorization, as if it is unable to correctly interpret the Microsoft Graph response.

For reference:

• Cisco ISE is configured to purge stale endpoints after 30 days (ENDPOINTPURGE: ElapsedDays GREATERTHAN 30).
• Intune is configured with a 120-day device cleanup rule.

The following scenarios work as expected:

• Brand-new iPad enrollments.
• Re-enrollment of iPads that still exist in Intune.

The issue only affects iPads that were deleted by the Intune cleanup rule and then re-enrolled.

As part of my troubleshooting, I have:

• Cleared the endpoint history in Cisco ISE multiple times.
• Deleted the affected devices from both Intune and Microsoft Entra ID.
• Re-enrolled the devices from scratch.

Unfortunately, none of these steps have resolved the issue.

At this point, I'm running out of ideas and suspect there may be some stale mapping or synchronization issue between Cisco ISE and Microsoft Graph that is not immediately visible.

Has anyone encountered a similar issue or have any suggestions on what else I should investigate? Any advice would be greatly appreciated.

[Arne Bier]

I have not done this use case myself. Do you have a TAC support case ? What version and patch of ISE  ?

[cghaderpour]

I have ISE ver 3.3 and patch 9.

TAC is created and cisco confirmed what I said above but I have not received any recommendation from them yet.

[Greg Gibbs]

The ISE MDM integration uses the MS Compliance Retrieval API for device lookups. As I understand it, this is a different table than the Device Management table you are likely querying manually and is syncronised at some periodic interval from the other table(s).

I have heard of some customers having issues where that sync interval was not frequent enough which resulted in a disconnect between what the CR API responded with and the real compliance status of the endpoint. My guess is this is something similar.

If you have not engaged MS support around this, I would suggest doing that as well to see if they have any additional visibility into this aspect.

The only other thing I could suggest is looking to upgrade to 3.4 or 3.5 and using the Device Query feature instead of the traditional MDM integration. The Device Query uses the normal device Graph API lookup instead of the GUID based lookup against the CR API and that lookup includes the attributes like isManaged and isCompliant.

https://community.cisco.com/t5/security-knowledge-base/cisco-ise-with-microsoft-active-directory-entra-id-and-intune/ta-p/4763635#toc-hId--1730613709

[cghaderpour]

Greg, your recommendations have always been helpful; I will follow up with Cisco Support, and if they cannot figure it out, I will return to your guidance. Thanks

[cghaderpour]

I just wanted to provide an update. I restarted the ISE application on all nodes and disabled and re-enabled the MDM integration. That appears to have resolved the issue. I tested a few affected iPads afterward, and they all connected successfully.

Thanks.