Capabilities

This page enumerates the functional capabilities of Endpoint Manager for ISE. Each capability is described in declarative terms — what it does, what it depends on, and what is included.

Endpoint Identity Group administration

A managed Endpoint Identity Group in Endpoint Manager is a 1:1 reflection of a Cisco ISE Endpoint Identity Group. The ISE group remains authoritative; the platform applies a delegated-administration layer on top.

Capabilities:

• Browse all Endpoint Identity Groups exposed by Cisco ISE — connected and not-connected — from a single list.
• Connect an existing ISE Endpoint Identity Group to bring it under managed administration.
• Create a new Endpoint Identity Group from the platform; it is provisioned in Cisco ISE and connected in a single step.
• Rename a connected group; the change propagates to Cisco ISE.
• Disconnect a group, removing its delegated-administration layer (and associated Self-Service Users and managed settings). Cisco ISE retains the group and its endpoints unchanged.

Endpoint operations

Per-endpoint administration inside a managed group:

• Add a single endpoint with MAC address, description, and a value for every endpoint level attribute the group has opted in to.
• Modify the description and any endpoint level attribute value. The MAC address is immutable.
• Move an endpoint to another connected group within the same Context.
• Revoke (remove) an endpoint from a group. If the endpoint is no longer a member of any group, it is removed from Cisco ISE entirely.
• Live session data, read directly from Cisco ISE’s Monitoring API: NAS device, port, VLAN, IPv4 address, session duration, data usage (up/down), and current connection state.

All endpoint operations are pushed into Cisco ISE through its standard APIs.

Custom attributes

Cisco ISE’s Endpoint Custom Attributes can be exposed for delegated administration. The Context owner decides which attributes are eligible and at which level; the value is then set either once for a whole group or separately on each endpoint.

• Group managed. One value held on the group and applied to every endpoint in it. A periodic verification task re-applies the value if it drifts on the Cisco ISE side.
• Endpoint managed. The group opts in to the attribute, and a value is stored on each endpoint, entered when the device is added or edited.

The level is chosen when the attribute is created and cannot be changed afterwards, so an attribute is one or the other and never both. There is no override relationship between the two levels.

Device type is itself an endpoint level attribute now: the platform seeds a system attribute named Device Type, pre-selected on every group, with a curated list of options and icons that an administrator can edit.

Every attribute you want to manage, at either level, must already exist in Cisco ISE. See Custom Attributes for the definition grammar, the input types and the exposure model.

Identity PSK

An attribute can hold a Wi-Fi pre-shared key that the platform generates and rotates, in one of two shapes:

• One shared key for a whole group, activated on the group and pushed to every endpoint in it.
• A unique key on every device, generated when the device is added.

A group carries either shape but never both, and at most one key attribute of either kind. Updating or regenerating a group key rewrites the key on every endpoint in the group and triggers a Change of Authorization for the whole group, so the previous key stops working immediately.

Keys are shown in clear text to users who are entitled to the group that holds them. The hide control is screen privacy, not access control, and any member of a self-service group can see any other member’s device key. A key per device means a unique key per device; it does not isolate one user’s key from another’s. See Identity PSK.

Batch import (CSV)

Bulk onboarding of endpoints from a CSV file. Available to administrators on the Netgraph admin side as well as Group Administrators in the Self-Service portal:

• Four-step wizard — file selection, validation, preview, and submit.
• Preview before commit — every row is validated before any change reaches Cisco ISE.
• Auto-move of existing MACs — a MAC address that already exists in another Endpoint Identity Group is moved into the target group (with explicit user confirmation), rather than rejected.
• Audited — each row is recorded individually in the Context’s audit log.

The file carries MAC address, description and an optional device type. Endpoint level attribute values are not supported in batch import: add the endpoints first, then set the values on each device. Key attributes set to generate automatically still produce a key for every imported device.

Change of Authorization (CoA)

Trigger a CoA on a live endpoint to force Cisco ISE to re-evaluate its authorization policy. Typically used after moving an endpoint to a different group or after changing an attribute value that affects authorization. CoA is available to Organization administrators only — Self-Service Users cannot issue CoA.

One CoA happens without being asked for: updating or regenerating an Identity PSK. A group key re-authenticates the whole group, a device key re-authenticates that one device.

Self-Service Portal

A dedicated web portal for delegated administrators. Capabilities:

• Per-group scope. Each Self-Service User sees only the groups they belong to.
• Endpoint CRUD — add, modify, move, revoke endpoints inside the assigned group.
• Live session view for each endpoint.
• Batch import via the same CSV wizard as the admin side.
• Group Users management — Group Administrators can invite, modify, and revoke other Self-Service Users on the same group.
• Attribute values — every endpoint level attribute the Context has marked editable can be set by the user when adding or editing a device. Attributes marked display only are shown read only.
• Identity PSK — reveal, copy, update and regenerate a device key, and read it as a Wi-Fi QR code. For a shared group key, a three step connect guide appears once the group has a Wi-Fi SSID.
• No Cisco ISE access — the portal never exposes Cisco ISE’s admin surface, credentials or policy configuration.

Sign-in options

• Email invitation link — a magic-link login sent to the invitee’s email address.
• SAML 2.0 Single Sign-On — federated login via the customer’s Identity Provider. Optional Self-Service Enrollment automatically provisions users on first login if the group permits it.

Role-based access control

Three roles, each scoped to where it operates:

Role	Scope	Capability
Organization administrator	The Organization and all Contexts.	Connect Contexts, define Managed Attributes, manage groups, review audits, issue CoA.
Group Administrator	One Endpoint Identity Group.	Full endpoint CRUD on the group; invite, modify and revoke Self-Service Users on it.
User (default)	One Endpoint Identity Group.	Endpoint CRUD on the group; cannot manage other Self-Service Users.

A single individual can hold different roles on different groups simultaneously without conflict.

Webhooks

Outbound event delivery to customer systems for change-tracking and integration:

• Event type: ise.configuration.audit — emitted for every configuration change inside a Context.
• Subscription: per Context, with one or more HTTPS endpoints.
• Payload: structured JSON with timestamp, actor, action, target and field-level diff where applicable.
• Typical consumers: SIEM (Splunk, Elastic, Microsoft Sentinel), change-management systems, chat (Slack, MS Teams) via a small bridge.

Audit log

A complete record of every change inside a Context:

• API credential updates.
• Custom attribute definitions, at either level.
• Group managed attribute values, and a group’s endpoint attribute selection.
• Group connect / disconnect.
• Endpoint add / update / move / delete.
• Change of Authorization triggers.
• Self-Service User invitations, role changes and removals.

Each entry carries timestamp, acting user, action, target and field-level diff where applicable. Available in the admin UI and via webhooks.

Integration log

A per-Context record of the outbound calls to Cisco ISE that failed, kept for 30 days. Each entry names the operation, who or what triggered it, the reason it failed, and the request as it was sent, with an explanation written to be acted on rather than escalated. It is the first place to look when an operation does not reach Cisco ISE. See Integration Log.

Administration

• Multi-language UI — admin and Self-Service portals support multiple languages.
• SAML 2.0 SSO — for administrator sign-in to the Netgraph admin portal.
• Multiple Contexts per Organization — each binding to a separate Cisco ISE deployment (e.g. production + lab).

Cross-product integration

Endpoint Manager shares Organization-level infrastructure with the other Netgraph Connectivity Platform modules — administration portal, Self-Service portal, audit logging, multi-language UI, SAML SSO, and Organization administrators. Customers running Endpoint Manager alongside Sign In, EntryPoint or EasyPSK get a single, unified administrative surface.