Custom Attributes

Cisco ISE lets you put arbitrary fields on an endpoint record, called Endpoint Custom Attributes. Endpoint Manager turns a chosen set of those fields into something a delegated administrator can maintain, without giving anyone a Cisco ISE login.

This page describes the model. For values that hold a Wi-Fi key, see Identity PSK.

Two levels

Every attribute is defined at one of two levels, and the level decides where its value lives.

Level	Where the value is set	What it is for
Group managed	Once on the group, applied to every endpoint in it	Data that is the same for the whole group: vendor ownership, site code, a policy tag, a maintenance window
Endpoint managed	On each device, when it is added or edited	Data that differs per device: asset ID, end date, owner, a device key

The level is chosen when the attribute is created and cannot be changed afterwards. To move an attribute to the other level, remove it and add it again.

Because of that, an attribute is group managed or endpoint managed and never both. There is no override relationship between the levels, and no situation where a group value and an endpoint value compete for the same field.

A group can manage any number of attributes at each level at the same time. The only either-or rule concerns Identity PSK.

The attribute must exist in Cisco ISE first

Endpoint Manager never creates attributes in Cisco ISE. Before you define one, it must already exist under Administration → Identity Management → Endpoint Custom Attributes.

Warning

Cisco ISE discards values for attribute names it does not recognise, and it does so without returning an error. A name that does not match an attribute in Cisco ISE will save on the platform, look correct in every view, and never reach the endpoint. Check the spelling against Cisco ISE before you rely on the value.

Anatomy of a definition

Attributes are defined per Context, on the Managed Attributes tab, which is split into one sub-tab per level. The form has three parts.

Identity

Field	Rules
Attribute Name	Must match the Endpoint Custom Attribute in Cisco ISE. Starts with a letter, then letters, digits, underscore or hyphen, up to 64 characters. Unique within the Context. Immutable after creation.
ISE Type	One of String, Integer, Boolean, Float, Long, IP Address, Date. Immutable after creation.
Display Name	Optional. Shown to readers instead of the attribute name.

Names beginning with ng are reserved for platform attributes and are rejected.

There is no free text description field on an attribute. The only label is the Display Name. Descriptions exist on the individual options of a dropdown.

Behavior

Input decides the control a person is given, which is not the same thing as the ISE type. A field can be stored as a String in Cisco ISE and still be presented as a dropdown of four approved values.

Input	Behaviour
Text	Free text
Integer	Whole number
Decimal	Decimal number
Toggle	On or off, stored as true or false
IP Address	IPv4 only. IPv6 addresses are rejected
Date	Date only, no time of day
Dropdown	A list of values you define
iPSK PSK	A Wi-Fi key the platform generates and rotates. See Identity PSK

Not every combination is valid. The ISE type constrains the inputs available to it:

ISE Type	Inputs allowed
String	All eight
Integer, Long	Text, Integer, Dropdown
Float	Text, Decimal, Dropdown
Boolean	Text, Toggle
IP Address	Text, IP Address, Dropdown
Date	Text, Date, Dropdown

An Identity PSK attribute must be typed String in Cisco ISE.

Required makes a value mandatory when a device is added. It is available on endpoint level attributes only, and never on a Toggle, which always has a value, or on a key attribute, which the platform generates.

Note

Batch import cannot carry attribute values. If a group uses batch import, do not mark its endpoint attributes Required.

Exposure

Exposure decides what a delegated administrator sees in the Self-Service portal. An attribute is always visible in the admin console regardless of this setting.

Exposure	Effect in Self-Service
None	Not shown. The attribute stays administrator only
Display	The value is visible on the user’s devices, read only
Editable	The user can also set the value when adding or editing their own devices

Editable requires an endpoint level attribute. Group managed values are set by administrators; a group managed attribute can at most be displayed.

Two conditions must both hold before a user sees an endpoint attribute: exposure is not None, and the group has opted in to the attribute.

Dropdown options

Each option carries a value, a description and an optional icon. The value is what is written to Cisco ISE; the description is what people read, in the picker and in every read only view. This lets the stored value stay machine friendly while the reader sees something meaningful.

Values must be unique, non empty, and valid for the ISE type. Options are matched exactly, including case.

Device Type, the one system attribute

The platform seeds a single system attribute into every Context: Device Type, an endpoint level dropdown with a curated list of options and icons, editable in Self-Service, and pre-selected on every group. It replaces what used to be a fixed device type field, so device type now behaves like any other endpoint attribute.

Its name, ISE type, level and input are fixed and it cannot be removed. Its options, its Required flag, its Display Name and its exposure are yours to change.

Where values are set

Group managed values live on the group’s Custom Attributes tab. A group manages an attribute when it holds a value for it. The value reaches every endpoint in the group immediately, and a periodic verification task re-applies it if something changes the value on the Cisco ISE side, for example an edit made directly in Cisco ISE or an endpoint added outside the platform.

Endpoint managed values are opted in per group on the same tab, then entered per device. Only the attributes a group has opted in to appear in its device forms. Endpoint values are written straight to Cisco ISE and read back live; the verification task never touches them.

Removing an attribute from a group stops the platform managing it. It does not remove values already written into Cisco ISE.

What the platform does not do

• It does not create, rename or delete attributes in Cisco ISE.
• It does not evaluate the values. An attribute holding an end date does not expire anything by itself. It has an effect only through an authorization rule you write in Cisco ISE.
• It does not carry attribute values through batch import, with the exception of device type.
• It cannot change an attribute’s name, ISE type or level after creation.