What do you mean by "mask MAC address devices"?
Do you mean a MAC address that has been locally assigned via configuration on the end device vs. Burned In Address from the manufacturer of the NIC?
If that's what you mean then - no, ISE cannot detect that directly.
We can use profiling to determine that a device that may appear to be one thing (a printer, for example, based solely on the reported MAC address OUI) is not actually that based on its behavior on the network.
