Hi @jitendrac
The only supported inner authentication method I know of that is supported by AzureAD and ISE, is PAP (Plain Auth Protocol).
The reason why, is for the same reason that we cannot do MSCHAPv2 to an LDAP repository - e.g. if ISE talks to an active directory domain controller using LDAP, then you cannot perform MSCHAPv2, because the "challenge" handshake process involved in the password checking, is a special process that happens. MSCHAPv2 works only when ISE is integrated (joined) to the domain controller and used Kerberos (and all that other stuff I don't understand ...). Thus, the only solution with ISE talking to LDAP, is PAP. ISE presents the username and password to the LDAP server, and the LDAP server compares the credentials in its databased - if it matches then the response is positive, else, the auth fails. MSCHAP is much more complicated and there are various versions that Microsoft developed over the years. My suspicion is that on the Azure side, there is no support for any method other than PAP. ROPC builds the secure tunnel between ISE and Azure. What you do in that tunnel is secured - hence no need for the complicated CHAP song and dance routine.
Username/password credentials checking is likely to become extinct one day because Microsoft is slowly replacing those ageing methods with more complicated forms, sometimes based on biometrics (i.e. Windows Hello). Windows Credential Guard feature is another thing that throws a spanner in the works - you can disable it, but it's not advised.
