A healthcare provider must admit 200 domain-joined staff with PEAP, 60 contractors who exist only in the corporate OpenLDAP directory, 20 lab devices that authenticate with machine certificates, and 12 administrators who must pass a second factor. Which identity store should serve each of these four groups?

The required mapping uses Active Directory for domain-joined staff authenticating with PEAP, the corporate OpenLDAP directory for contractors whose accounts exist only there, machine certificates for lab devices, and an MFA server for administrators who must pass a second factor. Using EAP-TLS for staff would replace the specified PEAP method; EAP-TLS is a well-established certificate-based method, but it does not meet this requirement. Storing contractors in ISE’s internal identity store is unsuitable because their accounts exist only in OpenLDAP; without creating and maintaining duplicate accounts, ISE cannot authenticate them from its internal store. Using MAC Authentication Bypass (MAB) profiles for lab devices would not authenticate the stated machine certificates. MAB is commonly used for devices unable to perform stronger authentication, but it does not satisfy the certificate requirement. The remaining mapping assigns the stated identity source or authentication method to each group. Exam caveat: a supported identity source alone does not guarantee that an EAP method can validate credentials; the protocol, directory capabilities, and policy configuration must align. Practical check: test one representative endpoint from each group and confirm its authentication method and selected identity store in the RADIUS authentication logs.