A city library runs ISE across twelve branches. The self-service kiosks all use one MAC range, but after firmware updates the profiler labels them printer one week and unmanaged device the next, so they drift between endpoint identity groups. Both the circulation access rule and the monthly asset report read the endpoint identity group Kiosks, so membership must hold across profiling cycles. Which assignment method pins every kiosk to that group?

Endpoint identity groups are what policies and reports actually read, and ISE fills that field in two different ways: profiling can assign the group as part of a profile result, or an administrator can set it directly on the endpoint record. The static assignment stays in place when a later profiling cycle produces a different result, which is exactly what the library needs while the kiosk firmware keeps shifting the best match between printer and unmanaged device. Mapping the kiosk profile to the Kiosks group inside the profiling policy looks right but inherits the profiler's indecision, because each cycle that selects a different profile also selects a different group, so membership still drifts. Matching the access rule on the endpoint profile name sidesteps the group entirely, which leaves the monthly asset report with nothing to query since the report reads group membership. Matching on switch or branch attributes scopes access by physical location and works well when devices rarely move, but it never populates the group field, so the reporting requirement remains unmet. One exam caveat: profiling still runs for a statically assigned endpoint and keeps updating profile attributes, only the group itself stays fixed. A practical check: assign one kiosk statically, force a profiling update, and re-read that endpoint's identity group to see it unchanged.