ISE anyconnect access with AD

[mickyq]

Is it possible to use the ISE to permit specific anyconnect url access using a specific AD group?

the problem I have is there are several anyconnect vpn url's available but the AD group the ISE is using is the VPN_Access group. Within the VPN_Access group are more groups with users in. The user can use any anyconnect url and gain access.

Is there a way to match an incoming url to a specific group in the VPN_Access group

[jan.nielsen]

I believe that the ASA sends the tunnel-group name that the users is hitting, with the radius request, tunnel-group is normally mapped in the ASA to a specific url. You could create multiple authorization rules that have condition matches on the pairs og tunnel group names and a specific AD group you have, to allow access, and then deny everything else.