This is a unique issue as TAC has been having a hard time figuring it out.  One minute it starts working, another it doesnt.  So to break it down, we are using: Not WorkingCatalyst 9410 -- Latest version 16.9.4 with two patches. WorkingCatalyst 4506 ...

ISE 2.3.0.298 External Sources: AD Mode: Monitor MAR: On (12hrs) Cisco Phones-EAP Switches: Correctly Configured per Interface   Policy:      Authentication:      EAP-TLS - Network Access·EapTunnel Equals TTLS - Use Sequence (Internal Endpoints, AD) ...