A company already manages its mobile devices with an MDM platform that tracks encryption, jailbreak status and PIN enforcement. It wants Cisco ISE to grant network access based on that compliance without installing another agent. What should be configured?
Select an answer to reveal the explanation.
Short Explanation
Why make the phone take the same test twice? Your MDM already graded it, so ISE just asks the MDM for the result and uses that in the authorization rule. Profiling the phone as compliant is the trap; knowing it's an iPhone tells you nothing about whether it's encrypted.
Full Explanation
Cisco ISE supports integration with MDM and enterprise mobility management platforms through an API. When a mobile device authenticates, ISE queries the MDM for attributes such as whether the device is registered, compliant, encrypted, jailbroken or has a PIN, and authorization rules use those MDM attributes as conditions. Registered, compliant devices receive full access; unregistered devices can be redirected to enroll, and noncompliant devices receive restricted access. No additional agent is required because the MDM agent already provides the data. Installing an ISE posture module on phones is not the model ISE uses for mobile platforms and duplicates the MDM's role. A profiling policy identifies device type from network attributes and cannot determine encryption or jailbreak status, so labeling every phone compliant removes the control entirely. Allowing phones through MAB and hoping the MDM blocks risky ones disconnects enforcement from the network: the MDM can manage the device but does not decide network access in this design. Exam caveat: the MDM is an external compliance source; if it becomes unreachable, the policy needs a defined fallback. Operational check: in the ISE live log for a phone session, confirm MDM compliance attributes were returned and matched the expected authorization rule.