Customer commented today that they were under the impression that the ISE BYOD solution has the ability to renew a client's certificate without user intervention (i.e. supplicant performs an auto enrollment prior to the cert expiration). I am pretty sure this is not the case, and that the process is very manual (i.e. ISE has to redirect user to a portal and user goes through all the motions again as they did when they initially on-boarded).
It's my understanding that in order to do what my customer is expecting, you would need an app that lives on the device (like an MDM app) that can initiate the SCEP etc.
