A 300-person design agency wants staff laptops to join WPA2-Enterprise using EAP-TLS. IT will not ask users to install certificates by hand, and the issuing CA must be ISE itself. On first connection each laptop walks through registration, receives its supplicant settings, and is issued a certificate before normal access is granted. Which ISE components complete this first-time BYOD onboarding flow?

The BYOD portal guides the laptop through registration and delivers the supplicant configuration needed for EAP-TLS, while ISE’s internal CA issues the client certificate. Together, these components support the required first-connection flow, with the certificate available before normal access is granted. An enterprise PKI can issue EAP-TLS certificates in many designs, but it does not meet the requirement that ISE itself be the issuing CA. MDM can pre-enroll laptops, deploy their EAP-TLS profiles, and obtain certificates from ISE’s internal CA, but that stages the laptops rather than having their first connection trigger registration and delivery of settings. The BYOD portal and ISE internal CA are the right components, but issuing certificates only after production authorization reverses the required order: the EAP-TLS certificate must be available before normal access. Exam caveat: ISE’s internal CA capability and supported BYOD enrollment steps can depend on the ISE release and deployment configuration, so not every certificate workflow uses the internal CA. Practical check: test with an unenrolled laptop and verify in the portal and ISE logs that registration and profile delivery occur first, the internal CA issues the certificate, and authorization changes to normal access only afterward.