I just recently had something similar happen with a migration to Azure project.  Turns out, the CA used to sign the ISE node Admin certificate was a CA preloaded in ISE. The Root CA cert only had "Cisco Service" selected.  I selected "Infrastructure"...

The justification for this change is wild.  You're saying that because you cant clearly identify for customers which sessions are consuming advantage licenses, you'll just charge for all of the active sessions.    This change will force customers to ...