Identity PSK

An attribute whose input is iPSK PSK holds a Wi-Fi pre-shared key that Endpoint Manager generates, stores on the Cisco ISE endpoint record, and rotates on request. Cisco ISE still serves the key and still makes every authorization decision. The platform maintains the value and puts it in front of the people who need it.

Two variants

The level of the attribute decides the shape of the key.

Variant	Key	Typical use
Group managed	One shared key for the whole group	A fleet that connects with a single credential: a floor of IP phones, a batch of sensors
Endpoint managed	A unique key on every device	Devices that should be revocable one at a time without disturbing the others

A group carries one variant or the other, never both, and at most one key attribute of either kind. Activating a group key on a group that already has a per device key is refused until the first is removed, and the reverse holds too. The rule exists because a device would otherwise have two candidate keys and no way to tell which applies.

A Context may define several key attributes, for example one per SSID. The one-per-group rule applies to the group, not the Context.

Key format

Between 8 and 63 characters of printable ASCII. Spaces are allowed inside the key but not at the start or the end. Cisco ISE Identity PSK takes a passphrase, so the 64 character hexadecimal raw key form is not accepted.

Activating a shared group key

Adding a group key to a group opens an activation dialog with two decisions in it.

Wi-Fi SSID. The network the key belongs to. It is shown to self-service users in the connect guide and encoded in the QR code. It can be set later on the group’s Group Settings tab, but the connect guide stays hidden until it exists.

The key itself, where the choice matters:

• Use the group’s existing key. For a group whose endpoints are already in Cisco ISE and already connected with a key you know. Enter that key and the platform adopts it, so the synchronisation does not overwrite what the devices are using.
• Generate a new key. The platform creates a strong key and pushes it to every endpoint in the group.

Choosing to generate when the fleet is already connected replaces the key those devices hold, and they lose access at their next authentication. On an existing deployment, enter the key you already have.

The choice is available at activation only. Afterwards the key changes through the update and regenerate actions instead.

Rotating a key

Both Update PSK (you supply the new key) and Regenerate (the platform creates one) do the same two things: rewrite the key on every affected endpoint in Cisco ISE, and trigger a Change of Authorization so the old key stops working immediately rather than at the next natural re-authentication.

For a group key that means the whole group re-authenticates. For a device key it means that one device does.

Keys on individual devices

A per device key is generated when the device is added, unless the attribute has automatic generation switched off. When adding a device you can instead enter a key the device already uses, or add the device without a key and set one later from its detail view.

The add operation never returns the key. Read it from the device afterwards, in the admin console on the device detail page or in the Self-Service portal on the device itself.

Adding a MAC address that already exists in Cisco ISE adopts that endpoint into the group. A key it already holds is never silently rotated.

What a self-service user sees

For a shared group key, a three step connect guide appears at the top of their device list once the group has both an SSID and a key: register the device, connect to the SSID, enter the passphrase. The key can be revealed, copied, or read as a standard Wi-Fi QR code.

For a device key, each device carries its own key block with the Wi-Fi network name, and controls to reveal, copy, show as a QR code, update and regenerate. Revealing and copying require only membership of the group. Setting or regenerating additionally requires that the attribute is marked editable and that the user holds the group’s device administration role.

What a per device key is, and is not

Two things are worth stating plainly, because the natural assumption is wrong.

Keys are shown in clear text to users who are entitled to the group that holds them. The reveal control is a screen privacy toggle, not an access control.

Any member of a self-service group can see any other member’s device key. This is deliberate: an ISE group is administered collectively, and the people in it maintain each other’s devices. A key per device gives you a unique credential per device, which you can revoke one device at a time. It does not give one user’s key privacy from another user in the same group. If that separation matters, separate the groups.

Removing a key attribute

Warning

Removing a key attribute from a group does not remove the key from the endpoints in Cisco ISE. Those devices keep the key and keep connecting, but the platform can no longer show it or rotate it. Adding the attribute back generates a new key rather than recovering the old one, which will disconnect every device still using the previous one.

What Cisco ISE does with it

The key is written onto the endpoint as an Endpoint Custom Attribute, the same as any other managed value, which is what makes it available to your Cisco ISE authorization policy. The attribute must exist in Cisco ISE first, exactly as described in Custom Attributes, or the value is discarded without an error and no key ever reaches the device.