After joining ISE to the corporate domain, users sign in with their domain accounts but the employee-access rule never matches; the live log shows the identity name with no group attached. The policy team uses native AD identity sources only. Which step in the AD join and group retrieval workflow should the engineer verify first?
Select an answer to reveal the explanation.
Short Explanation
Since your users can sign in with their domain accounts, the AD join is likely working; verify that ISE retrieves the AD groups and that your rule references the selected external group. Internal groups duplicate domain data, LDAP changes the identity source, and rechecking the join or trust is less likely to explain a missing group.
Full Explanation
When ISE joins Active Directory, it creates a computer account and gains the ability to authenticate users, but group membership is not streamed automatically. You must retrieve the groups from the domain, select the ones policy will use, and make the authorization condition reference the retrieved external group object rather than free text. Because users here sign in successfully, the join itself is likely working; verify group retrieval and selection, then confirm the condition points to the downloaded group. Creating matching internal groups in ISE fails the native-AD requirement and duplicates identity data the domain already owns, so each new hire would require a second change. Pointing the identity source at LDAP over port 636 also fails the requirement to use native AD; LDAP would introduce separate base DN and attribute-mapping work. Rechecking the domain join status and trust is less likely to address the symptom because successful sign-in indicates that the join is probably functioning, even though it does not prove group retrieval is configured. Exam caveat: group matching uses the retrieved group identity, not a typed name, so select it from the downloaded list. Practical check: open the live log for one affected user, confirm the external group appears, then rerun the rule test.