Sorry please see attached diagram

I would recommend checking two locations to start. 1- In ISE authentications do you see the endpoint passing authentication and being delivered the next authorization correct authorization profile? Always double check the profile order as in the gues...