Showing results for 
Search instead for 
Did you mean: 

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

Leoni Wartung

ISE Sponsor Groups with different privileges

Hello Community, 


we are operation a ISE deployment for all of our sites araund the world. At the moment we are chanign our Guest Workflow to a Sponsor based deployment. 

Originally it was planned that every user can sponsor guest accounts but the requirements chagened. 


Now we have the the requirement that we have to controll it on a country basis.


We need for every country a Admin Sponsor group which can see all Accounts which are created in that Area. And the User should only see his Accounts. 


When i create a new sponsor group on a country Basis everybody how is in the group can see all accounts. Is it possible to solve that problem?


Regards Stefan 


As per my understanding all sponsor users can saw all the guest account.

Leoni Wartung

Yes that is possible, but i want, that the Manager of a Region can see all Guest Accounts from that Region. But the Sponsors should only see there created Accounts. 


Lets say, i have only one region, than its not a problem. But i have lets say 20 Regions. 


Regards Stefan 

Hi Leoni,

Maybe you could try to create multiple standard sponsor groups, in which each user would be able to see only his own accounts. You would achieve this by creating and configuring multiple locations, and option Sponsor Can Manage: Only accounts sponsor has created.

You would then create manager sponsor group, which would be combination of local location, and option Sponsor Can Manage: Accounts created by members of this sponsor group. Main idea is to use combination of Location and "Sponsor Can Manage" options.

I never used this combination, but logically, it might work.



Leoni Wartung, Milos has the right idea. Below is an example:


User Identity Groups

  • us-sponsors
  • us-managers
  • uk-sponsors
  • uk-managers
  • cn-sponsors
  • cn-managers

Network Access Users

For each region, sponsors will be in the sponsors group of that region but managers will be in both the sponsors and the managers groups of the region.


Sponsor Groups

  • us-sponsors : Duplicate of OWN_ACCOUNTS (default) but mapped us-sponsors as the only member
  • us-managers: Duplicate of GROUP_ACCOUNTS (default) but mapped us-managers as the only member
  • uk-sponsors : Duplicate of OWN_ACCOUNTS (default) but mapped uk-sponsors as the only member
  • uk-managers: Duplicate of GROUP_ACCOUNTS (default) but mapped uk-managers as the only member
  • cn-sponsors : Duplicate of OWN_ACCOUNTS (default) but mapped cn-sponsors as the only member
  • cn-managers: Duplicate of GROUP_ACCOUNTS (default) but mapped cn-managers as the only member




Cisco Employee

Create your sponsor accounts for each country and be sure to select:



Hello Thomas, 


yes, i know that option but than all users see the guest accounts and not only the Manager of the region. 



Recognize Your Peers
Content for Community-Ad

ISE Webinars

Miss a previous ISE webinar?
Never miss one again!

CiscoISE on YouTube