ISE assign SGT base on AD Group

[raymondluis13]

I have an ISE that connected to the AD. So, i want to assign the same group in AD (ip, devices, and all) to the SGT automatically. For example, if i have an IT group and HR group in AD, the ISE will automatically make SGT with the same group. And if the member of the group in AD is changing, the ISE will automatically change the SGT based on AD.

[ahollifield]

You can assign an SGT based on any authz profile in auth (which includes AD group).  What is your question?

https://community.cisco.com/t5/security-documents/how-to-ask-the-community-for-help/ta-p/3704356

[Aref Alsouqi]

You can do that by selecting the SGT you want to assign to the users/devices from the "Security Groups" column in the "Authorization Policy" in the policy set. It is basically the column next to the profiles column where you assign the authorization profile. Obv, the SGTs should be created in advance, you can create them from the "TrustSec" section > Components > Security Groups.