Multiple ISE integration with MS Intune

[Phil Evans]

Hi

We have an Azure and Intune tenant where we have multiple subsidiaries with their own Cisco ISE implementations that would (ideally) require the CISCO ISE <> Intune Integration.  Can anyone from the CISCO community tell me if this is a supported scenario?  Can multiple app registrations be created and the associated certificate instances be created so that each organisation can operate independently with their ISE implementations (with a common Azure tenant) ?

Would greatly appreciate thoughts !

Thanks

[Greg Gibbs · Accepted solution]

We might need to understand a bit more detail about what you are trying to achieve.

• Why would you need separate App Registrations? Are you somehow restricting each App Registration to a specific domain?
• Are you only concerned about performing MDM lookups using the Intune device GUID and you're still performing authentication of the endpoints/users against traditional AD?
• What version of ISE are you using?

In my Azure/Intune testing, I have used separate App Registrations (single tenant) in the same Azure tenant for separate ISE instances (for example ISE 3.1 vs 3.2 instances). Both instances are able to perform MDM lookups using the Intune device GUID for the user or computer certificate presented for the EAP-TLS session. This works for both Hybrid Azure Ad Joined as well as Azure AD Joined devices as per the scenarios described in the following document.
https://community.cisco.com/t5/security-knowledge-base/cisco-ise-with-microsoft-active-directory-azure-ad-and-intune/ta-p/4763635