Is there a way to have a 21 day Grace Period for a Posture Rule and Scan endpoints every time they connect to the network over VPN?
-I am not 100% sure this is feasible due to the fact that that the grace period needs to be less than the posture lease time, and since you want to scan every time a device connects it won't work. I would suggest pinging TAC on this one too if nobody else provides feedback here. Lastly, two options I think may work for you is to scan every time someone connects to the network, but have that specific check as 'optional' or 'audit'. The two differences are described below:
When set to optional:
During policy evaluation, the agent provides an option to clients to continue, when they fail to meet the optional requirements specified in the posture policy. End users are allowed to skip the specified optional requirements.
For example, you have specified an optional requirement with a user-defined condition to check for an application running on the client machine, such as Calc.exe. Although, the client fails to meet the condition, the agent prompts an option to continue further so that the optional requirement is skipped and the end user is moved to Compliant state.
When set to Audit:
Audit requirements are specified for internal purposes and the agent does not prompt any message or input from end users, regardless of the pass or fail status during policy evaluation.
For example, you are in the process of creating a mandatory policy condition to check if end users have the latest version of the antivirus program. If you want to find out the non-compliant end users before actually enforcing it as a policy condition, you can specify it as an audit requirement.
IMO doing an audit and keeping an eye on it for internal reporting purposes would give you insight on who is compliant and who is not prior to enforcing the check at 21 day mark.
Also, check this out for additional help: ISE Posture Prescriptive Deployment Guide - Cisco Community
HTH!
