@Aref Alsouqi, nope. AD user is created in AD only. AD group is called out as an ISE admin group. User wont be permitted to login to ISE GUI, if it's not created in ISE as an external password user.

Guys i tested this in the lab with ISE 2.7 version. 1. Created an AD group in AD and added users (aduser1) to it.2. Created external Administrator Group in ISE and selected the AD group3. Logged into the ISE portal with username aduser14. Result - Ad...

oops that's shocking, is there any way to control this in ISE.AD is handled diff department. Creating groups, adding/changing users to that group ha lengthy process and wait period.

Thank you @Ken Stieers and @Aref Alsouqi the links shared are very useful, it cleared almost all the confusions.Currently umbrella roaming users have anyconnect ASA VPN. The best approach I understand is to deploy umbrella secure client from ASA.For ...

Will this affect the cluster? as i have used same admin user for joining nodes to cluster.