Yes, just tested it.However if you use always on VPN and/or cert auth for users you will posture the endpoints two times.Better to apply posture only for the user connection if the above conditions apply.

I just configured this.Created a separate AAA group on ASA for ISE where the authorize-only option is checked.Assigned it to the respective tunnel-group's advanced/authorization section.The tricky part was getting the correct username from the comput...