A regional clinic can broadcast only one staff SSID. Laptops already authenticate to it with 802.1X, while staff phones arrive unenrolled and must pass through ISE's onboarding portal to receive certificates before they are trusted. Which BYOD flow fits this single-SSID site?
Select an answer to reveal the explanation.
Short Explanation
Single-SSID BYOD keeps clients on one network and redirects the phone to the portal after its initial authentication. It's like getting your badge at the foyer door and then walking straight in. The portal handles onboarding, and ISE re-authorizes the device afterward.
Full Explanation
Single-SSID BYOD uses the same wireless network for enrollment, provisioning, and network access: the device associates, receives an initial authentication result, and ISE applies a redirect so the browser lands on the onboarding portal. There, the user accepts the policy and the device receives the issued certificate and supplicant profile before ISE re-authorizes the session with a Change of Authorization. This fits a site allowed only one staff SSID, because onboarding happens on the same network the client will keep using, and the laptops' existing 802.1X access is untouched. Dual-SSID BYOD uses a second provisioning network, often open, so it does not fit the single-SSID constraint. Guest self-registration provides guest access rather than registering the device with a corporate certificate. Disabling 802.1X and profiling by MAC address removes the laptops' existing authentication method and does not onboard the phones with certificates. Exam caveat: the initial authorization rule must carry the redirect, so confirm the redirect ACL or URL redirect on the WLAN before testing. Practical check: join with a personal phone, watch ISE Live Logs for the portal hit, and confirm a Change of Authorization follows onboarding.