New capabilities, improvements and changes to existing behaviour across every service, newest first.
Bug fixes and routine maintenance are not listed here. Each service also keeps its own Release Notes page, showing the same entries filtered to that service.
123 entries
New
An EasyPSK service groups its groups into sites, each with a policy for new groups: Self-Service Experience, security flavour, device cap and Valid for (days). Groups without a site land in the Default Site. A Site manager role names its sites, its members by email address or team, and what they see and may do in the Self-Service Portal, from creating groups and regenerating keys to printing Wi-Fi Key Cards.
New
Under Self-service onboarding an EasyPSK service holds named rules that give a person a group of their own at their first sign-in to the Self-Service Portal. A rule matches an email domain, an address or a Self-Service Team, and sets the new group’s flavour, Self-Service Experience, site, device cap, validity, the user’s roles and how the group is named. Check an address shows which rule applies.
New
Print Wi-Fi Key Cards prints a card per Instant group with the network name, the key, a QR code, the group label and the end date, from named designs with a logo and texts. Print every Instant group, chosen sites and groups, or a Self-Service portal poster with a QR code. Site managers print from the Self-Service Portal. Prints and design changes are audited.
New
An EasyPSK service chooses one of six Self-Service Experiences: Home-like Wi-Fi, Co-working, Campus, Expo halls, Hospitality or IoT, and a site or a group can choose another. The experience sets the wording of the new Self-Service Portal, the welcome mail and the label on Wi-Fi Key Cards. Approved and Dedicated groups without a choice are IoT. The experience does not affect access.
New
An EasyPSK group’s Rules card holds its site, Self-Service Experience, device cap, Valid until and a switch for wired devices. At the cap new devices are refused. After Valid until the group is archived and its devices denied, and an administrator can reactivate it until the archive retention ends, 30 days by default. Members block devices and register wired devices by MAC address in the Self-Service Portal.
New
Create in bulk on an EasyPSK service’s Groups page creates groups as a numbered series or from a CSV file, with flavour, site, Self-Service Experience, device cap, end date and optional invitations. The run is shown as a plan, approved and carried out, with Earlier runs as history. A CSV can also reset or delete the groups not in the file. Site managers create series in the Self-Service Portal.
New
Under Service settings, Terms & Privacy holds an EasyPSK service’s terms of use and privacy notice, in English with the other portal languages beside it. With Users accept the terms switched on, a self-service user accepts them before the portal opens. After an edit the service can ask everyone to accept again, and each user sees the versions they have accepted.
New
A replaced key can be restored for seven days: the shared key of an EasyPSK group, the key of a Dedicated device and the key of a Meraki WPN group. Restore previous PSK is in the Administration Portal and Restore previous key in the new Self-Service Portal. Devices that still use the earlier key connect again without changes.
Changed
An EntryPoint or EasyPSK service opens on a Groups page with the tabs Groups, Devices, Self-Service Users and Authentication Log, filter chips with counts, a Site column and search across groups and sites. Add Group opens a wizard, also for 802.1X groups, that can add the group’s first user or team. Devices show their IP address. Chromecast, Apple TV and Soundbar are device kinds.
New
Under Self-Service Portal, Teams an organization keeps teams of email addresses, added by hand or provisioned over SCIM. A team is bound to a Sign In access policy, to an EasyPSK, EntryPoint or Endpoint Manager group with the roles its members get, to an EasyPSK onboarding rule or to a Site manager role. A binding can send a welcome mail to people who join later.
New
Deleting a team, removing a member or unbinding a team opens one dialog that counts the people who lose access and what happens per service: Sign In sessions end and pending guest requests are declined, personal PEAP accounts are deleted, and personal EasyPSK groups are deleted. The removal takes effect within a minute and cannot be undone.
New
Self-Service Portal, Provisioning adds a SCIM registration for self-service users, with its own bearer token and activity log. Provisioned groups become Self-Service Teams marked SCIM, and a changed user name moves everything to the new address. A person the identity provider blocks or removes from a group loses access at once, and their PEAP accounts and EasyPSK groups are kept blocked for 30 days in case they return.
Changed
When the identity provider sets an administrator inactive, the administrator is now blocked instead of removed. Roles and teams are kept, and setting the person active again within 30 days restores them. After 30 days the administrator is removed. A delete still removes at once. The Administrators list hides blocked administrators unless Show blocked is on.
New
A new Self-Service Portal runs beside the classic one. The organization chooses the Default portal, Classic unless changed, and each user can switch. An EasyPSK group opens on a home page with the network, the password, the QR code, the devices with online state, the device cap and Register a device for Wi-Fi or cable. Sign In, EntryPoint, EasyPSK and Endpoint Manager groups all have pages there.
New
Endpoint Manager for Cisco ISE groups have their own pages in the new Self-Service Portal. Add a device works in steps and waits for Cisco ISE to confirm. The device panel shows whether a device is connected by Wi-Fi or cable, with switch, port and VLAN, and its IP address and session. Reconnect sends a Change of Authorization to an online device.
New
The organization menu has a Self-Service Portal section with Settings, Authentication, Teams and Provisioning. Settings holds the default portal, the appearance of the new portal (dark, light or match the device), the languages with a fallback, a light and a dark mode logo, and the portal address with Copy link. The logos are used on the new portal’s sign-in page and in Wi-Fi Key Card designs.
Improved
In the new Self-Service Portal a conference host downloads the answers attendees gave at sign-in as a PDF, or mails the PDF to their own address, beside the CSV export. A conference’s details list the latest answers and participants, with Show all.
Improved
The new Self-Service Portal has PEAP setup guides for Apple, Windows, Android, ChromeOS and Linux. The group page and the guides name the RADIUS server certificate the device should trust, taken from the certificate the EntryPoint service uses.
Improved
On an EntryPoint service’s Network settings, which also serve EasyPSK via RADIUS and RADIUS Proxy, the client secret is masked with Show, Copy and Generate. Generate creates a 24-character secret that takes effect with Update the secret. The Authentication Log of EntryPoint and EasyPSK services has a Live switch that refreshes it every five seconds.
Changed
Netgraph can pause a RADIUS service that receives no authentication or accounting requests. Its settings are kept, and its network settings show RADIUS service paused with the date requests stopped. Start service makes it accept requests again within a few minutes. This applies to EntryPoint, EasyPSK and RADIUS Proxy services and to MAC authentication for Sign In on Cisco Meraki.
Improved
EntryPoint and EasyPSK set a device’s type from the strongest source available, from host name and browser up to DHCP fingerprint, LLDP or CDP, the Cisco controller’s classification and the device model. A known type is never replaced by a weaker one, and a type a person chose is kept. Endpoint Manager offers the same device families, with 26 more types.
Improved
The audit log of the organization and of each Sign In, EntryPoint, EasyPSK and Endpoint Manager service is a timeline with search, a period, chips per kind of change with counts, and a panel showing each change before and after. Export CSV downloads the newest 5,000 entries.
Changed
The organization menu has an Administration section with Settings, Authentication, Administrators, Teams, Provisioning and Applications. Settings holds the organization’s name and website, its slugs and the network access list for the Administration Portal. Email MFA sits under Authentication, which also shows the Administration Portal address with Copy link. The identity pages open with a short introduction film and links to the documentation.
Improved
The Administration Portal, the MSP Portal and the Self-Service Portal ask Do you want to stay signed in? two minutes before an idle session ends, with a countdown, Sign out and Stay signed in. After a new version is deployed they show Portal updated, and the next page opens the new version.
Improved
The Alerts page in the MSP Portal groups services by tenant, with count cards for Critical, Warning, Unknown, OK and Not monitored, and starts filtered on Not OK. The tenant name opens the details, and Open tenant goes to the tenant’s page. A Service Gateway lists the state of each router and the affected DHCP scopes.
New
The Self-Service Portal sign-in page has Keep me signed in for 30 days on this device. It is unticked by default and shown when sign-in by email link or single sign-on is enabled. It applies only to the browser where it was ticked, and the sign-in ends 30 days after it was made.
New
The attribute dialog on the Managed Attributes tab takes an optional value prefix for String attributes, stored in Cisco ISE in front of every value. New iPSK attributes get psk= by default, as an iPSK authorization profile expects. Administrators and Self-Service users enter and see only the value; the prefix is shown in its own box beside it. Values already in Cisco ISE are rewritten to the current format at the next group sync.
New
Each managed attribute shows how many Endpoint Identity Groups use it, on both the Group Managed and Endpoint sub-tabs. The count opens a list of the groups, and each name links to the group’s Custom Attributes tab for administrators who manage groups. An attribute no group uses is marked Not used.
New
Under Selfservice Access Control, Authentication, Email Magic Link can be disabled once SAML 2.0 for the Self-Service Portal is enabled and configured. The portal’s sign-in page then shows only the SAML button, sign-in links already sent by email stop working, and emails that link to the portal lead to its login page. SAML 2.0 cannot be disabled while it is the only sign-in method. The setting covers the whole organization.
New
The menu of the MSP Portal, and of the Admin Console for the partner’s organizations, shows the partner’s logo at the top in place of the platform logo. Netgraph sets the logo for the partner: PNG, WebP or SVG, made for a dark background and with a transparent background. Without a partner logo the menu keeps the platform logo.
New
An Applications entry under Admin Access Control, in the Admin Console and in the MSP Portal, holds API keys for scripts and integrations. A key gets the APIs it may call at Read or Write level, the Sign In contexts it covers (all, including new ones, or a selection), a token expiry from 30 days to none, and an IP access list. The token is shown once; a key can be disabled and rotated with an overlap of up to seven days.
The Alerts page warns 30 days before a key’s last token expires and when it has expired, with a link to the key.
New
The Applications page shows the API base URL and every endpoint path with the organization, context and partner IDs filled in. With the Platform API an organization key reads the organization and its contexts and manages Sign In access policies, their email patterns and whitelistings, with batch create and revoke. With the MSP API a partner key reads the status of every tenant’s Sign In contexts: each Service Gateway router’s reachability and SXP connection, and the default gateways of the DHCP scopes, filterable on state.
Lists are paged with a cursor, errors carry one code per cause, and an OpenAPI description is served at /openapi.json under the base URL.
Changed
Under Configuration, Common Settings, a Sign In context with the per-context API key turned on keeps it, can replace the key and can turn it off, and once off it cannot be turned on again. A context without it shows an API access card that points to the organization’s API keys under Applications, which new integrations use.
New
The Policies page in the Cloud DNS section can check one domain against every policy in the context at once. Each policy answers whether the name is blocked, whether the name itself or a parent domain is listed, and which category or list of your own carries the entry. It also says when an allowlist entry does not cover the name because the block comes from a parent domain, and what to do about it. The lookup replaces the download of a policy’s effective list, which could not say which list caused a block.
New
A Statistics page opens the Cloud DNS section. It shows how many DNS queries the network answered and how many a policy blocked, as three figures and a trend for today, the last 7 or 30 days, or the last 6 or 12 months. Usage is sampled every few minutes and counted per network. The page follows the roles that read the context’s other statistics, so it can be followed without the right to change the filtering.
Changed
An entry in a blocklist of your own covers the domain and everything under it, so no wildcard is needed; a typed wildcard prefix or trailing dot is accepted and dropped, and an entry that cannot be a domain name is refused. An allowlist entry removes exactly the name it holds from what a policy blocks. The category catalogue lists the active categories only; a category the platform has switched off stays, marked inactive, in the policies that already selected it. Two categories are recommended, Malware, Phishing & C2 and Scam & Fake Shops. A policy holds at most 50 categories, 50 lists of each kind, and five million domains in total.
New
Cloud DNS now ships a catalogue of blocklists that Netgraph curates and keeps current, in three groups: Security, Content, and Ads and tracking. A category states what it covers and what it does not, its domain count and when it was last updated. Three categories are marked as recommended, and a context with no policy yet can start from them in one step. The catalogue is included in the add-on.
Changed
A context in Cloud DNS mode gets its own section in the menu, with three pages: Policies, Lists (Categories, Blocklists and Allowlists) and DNS settings (forwarding and internal DNS records). The DNS tab under Service Gateway now holds only the DNS mode switch. Rulesets are now called policies, and the editor is its own page: name, where it applies, when it applies on a week calendar with presets and a time zone, what it blocks, and what it always allows. Each policy card shows its status, what it blocks and allows, and how many domains that is, and can be duplicated.
New
A context selects its RADIUS server certificate under Configuration, Network Integration: a platform certificate kept current by the service, or a custom certificate you upload. The card shows subject, issuer and validity period.
When a replacement platform certificate is published it can be downloaded ahead of time, switched to early, and switched back from while the previous one is valid. Certificate warnings appear on the context Overview and Configuration pages, at 60, 30 and 14 days before a custom certificate expires.
New
A SAML registration shows the signing certificate it uses and the published replacement, each with fingerprint, validity period and its own download. The registration can be switched to the replacement early and back while the previous certificate is valid; the console asks for confirmation since the identity provider must hold the new certificate first.
The MSP Portal shows the same block on its registration view.
New
A new Alerts entry under Services in the left menu, with a count badge coloured by the most serious item. The page lists the certificate warnings from the RADIUS services and from single sign-on, filtered to what the administrator has rights to see, and each alert links to the page where it is resolved.
Improved
A Self-Service link now carries its organization in the address, and the older organization specific hostnames are recognised, so a shared link, an old bookmark or an expired session leads to the right sign-in page. The session expired notice is translated across the portal languages.
Improved
The pages reached from email links (sign-in confirmation, meeting host requests, sponsored device requests) are rebuilt as full pages in the portal look, with explicit approved, denied, revoked and not enabled states. A guest at the device limit picks the device to log out on the page, and each page renders in the language of the email it was opened from, offering only the languages enabled for the portal.
New
Custom attributes can now be defined as endpoint managed as well as group managed. A group managed attribute holds one value applied to every endpoint in the group, as before. An endpoint managed attribute holds a value on each device, entered when the device is added or edited, and is opted in per group. The level belongs to the attribute and is fixed when it is created.
A definition now also carries an input type (text, integer, decimal, toggle, IP address, date, dropdown or key), an optional display name, a required flag, and a self-service exposure setting of none, display or editable. Dropdown options carry a description and an optional icon, so the value written to Cisco ISE can stay machine friendly while readers see something meaningful.
Device type is no longer a fixed field. It ships as a seeded system attribute named Device Type, pre-selected on every group, whose options, requiredness and exposure an administrator can edit.
New
An attribute can hold a Wi-Fi pre-shared key that the platform generates and rotates: one shared key for a whole group, or a unique key on every device. A group carries one variant or the other, never both.
When a shared group key is activated you choose between supplying the key the group already uses and letting the platform generate a new one. Supplying the existing key is what lets you bring a fleet that is already connected under management without knocking it off the network.
Updating or regenerating a key rewrites it on every affected endpoint and triggers a Change of Authorization, so the previous key stops working immediately. You can also supply a key you already use when adding an individual device, not only when activating a group key.
A group now carries a Wi-Fi network name, prompted when a group key is activated. It is what the self-service connect guide and its QR code are built from.
Self-service users can reveal, copy and, where permitted, rotate their device key, and read it as a Wi-Fi QR code. Note that a group is administered collectively: every member of a group can see the keys of the devices in it.
Improved
The order you put the definitions in decides the field order everywhere the attributes appear, in both the admin console and the Self-Service portal.
Improved
The MAC format, that the attribute keys are known and at the right level, and that each value fits its input type are all checked up front. Batch rows are validated the same way, with the row number in the error, so a file that would previously have half-succeeded is rejected before it starts.
Changed
Previously a group wrote every attribute the service context defined and blanked the ones it had no value for. It now leaves attributes it does not manage alone.
Changed
Attributes the destination group does not manage keep the value they had, and endpoint level values are carried over untouched.
Changed
The periodic verification task never reads or rewrites an endpoint level value, so a per device asset ID or key is not corrected away by it.
New
A Sign In Enterprise network can be turned from plain DNS forwarding into a managed filtering resolver that Netgraph runs for it. Every lookup is checked against the policy you set before it is answered: blocked domains do not resolve, allowlisted domains always do.
You subscribe to blocklists by URL, which are fetched and kept refreshed for you, or build your own. Allowlists always override blocklists, and custom records map internal names to addresses.
A ruleset combines the lists, an audience of either the whole network or selected sites, and an optional weekly schedule with its own time zone, so a policy can apply only at certain hours.
Lists and records can be imported and exported in bulk, and the fetch status of a subscribed list shows when it was last refreshed.
New
An EasyPSK group can be given Attribute Profiles from its Group Settings, so the network policy returned at authentication, a VLAN through tunnel attributes or a Cisco security group tag, is set per group. The other EntryPoint variants already worked this way and EasyPSK now matches them.
Profiles are defined once on the service context and reused across its groups.
Improved
An Integration Log entry now carries the outgoing request exactly as it was sent, together with a ready to run command that reproduces it, so a failing call can be tested from elsewhere. Very large requests are stored in shortened form and offer no command, because it would no longer reproduce the original call.
Improved
A service context can disable HTTP keep-alive on its outbound calls to Cisco ISE, on the API tab of the context settings. Some load balancers and firewalls in front of Cisco ISE handle persistent connections poorly, and this is the switch for those deployments.
New
Batch Group Sync takes a CSV of groups, units and members and reconciles an entire context against it in one run. Groups and users are created, updated, reset or removed so the context ends up matching the file.
Nothing is applied before you have seen it. The file is parsed and analysed first, then a review step reports the counts per action and asks you to confirm the scope of what the run will change. A file with errors blocks the analysis rather than producing a half-applied run.
The run is monitored live, survives a page refresh, and can be exported as a CSV when it finishes. Earlier runs are kept in a run history.
It is reached from the Groups page of a Meraki WPN context. An example file can be downloaded from the upload step, and a context can export its current groups as a CSV to start from.
Improved
A member of a Meraki WPN group can carry a phone number. Administrators set it from the admin console, and group administrators can set or update it in the Self-Service portal.
The number has to include a country code. It is contact information held with the member and nothing is sent to it.
New
A Team is a named group of administrators that holds roles. Instead of assigning roles to each person, you grant them to a Team and manage who belongs to it. Every member inherits what the Team holds.
A Team can hold different roles in different service contexts, so one team can administer a context while holding read only access to another. Access to a further context can be added from the Team itself.
An administrator's detail page lists the Teams they belong to and what each one grants, so it is possible to see where a person's access actually comes from.
Available at organization level and, for partners, in the MSP Portal.
New
Administrator accounts and groups can be provisioned automatically from an identity provider over SCIM 2.0. When someone joins the relevant group in your directory they become an administrator here, and when they are removed or deactivated their access is withdrawn.
A provisioned group becomes a Team, so the roles granted to that Team apply to whoever your directory places in it.
A provisioning activity log records what the identity provider sent and what came of it, searchable and paged.
New
DHCP scopes can be uploaded as a batch instead of created one at a time, and the scope selector stays usable when a gateway carries a large number of them.
New
An organization, and a partner in the MSP Portal, can federate administrator sign-in with its own identity provider. The sign-in page offers the identity providers configured for the scope being signed in to.
A federation carries a default role, so someone who arrives without a role claim still lands with defined access, and roles can be mapped from the claim your identity provider sends.
Administrators who arrive this way appear in the list without having been invited, with the source of the account shown alongside the date they joined.
Improved
A context can export its whitelistings, and the import file accepts an optional end date column, so an entry can be given an expiry when it is created rather than afterwards.
New
A Self-Service User can see a device key, copy it, and read it as a Wi-Fi QR code together with the network name, without going through an administrator.
Rotating a key is tied to the user's role and can be switched off for the context, so an administrator decides whether delegated users may regenerate keys at all.
The device view also shows accounting data for the group, so a delegated administrator can see what is actually connected.
New
The portal is available in every language an organization can be set to. A language picker is offered, and the organization's own default takes precedence over a secondary browser language rather than losing to it.
The page also reports its active language to the browser, so screen readers pronounce it correctly.
Improved
Device type is derived from more of the profiling data the wireless network reports, so devices that previously showed as unknown are now classified. Apple TV, Apple Watch and HomePod are recognised as their own types rather than being lumped together.
New
EasyPSK can now be delivered over RADIUS, created and managed as a context variant of EntryPoint, alongside the existing Cisco Meraki WPN path. The key a device presents identifies its group, and the group's network attributes are returned at authentication, so keys resolve at connect time instead of being pushed into the wireless platform in advance.
This is the primary delivery for Cisco Meraki and Cisco Catalyst 9800. It carries far more keys than the Dashboard API path, which remains available and is capped per Meraki network.
A group is created with one of three flavours. Instant shares one group key and registers a device on first connect. Approved shares one group key but admits only MAC addresses registered in advance, with optional four-eyes approval. Dedicated gives every device its own key, and both the MAC and the key have to match.
New
Each service context now records the outbound calls to Cisco ISE that failed, and keeps them for 30 days: the operation, who or what triggered it, the reason it failed, and the response. Entries carry an explanation written to be acted on rather than escalated.
Failures are separated into distinct reasons, so an unreachable host is not reported as a certificate problem. The log is reachable from a tab on the service context and from the Cisco ISE API status card.
Improved
An account password is masked in the admin console list, with a show and hide control on each row, so the list can be read over someone's shoulder without exposing credentials.
New
A service context can now reach Cisco ISE through a Service Connector over IPSec instead of calling it over the public internet. The Cisco ISE deployment no longer has to be publicly reachable, and no inbound path from the platform to the ISE administration node is required.
The choice is made per service context on the Cisco ISE connection settings, between calling the API directly and routing it through the connector. Everything else about the integration is unchanged: the same three API families, the same API account, and the same behaviour in the console.
New
An organization can reach the platform over a private IPSec tunnel instead of the public internet. A firewall, or any device on your side that supports IPSec, establishes a single tunnel to a dedicated endpoint on the platform, and the services you bind to it carry their traffic through it.
EntryPoint's RADIUS path, EasyPSK via RADIUS, the platform's access to an on-premises Cisco ISE, and webhook deliveries can each be bound to the same tunnel. Sign In is not carried this way: it uses the Service Gateway.
A connector's page shows the settings to apply on your own device, including a worked Cisco IOS-XE example, the routes the connector publishes, and which services and ports are using it. Tunnel status is shown per connector, and the destination of a bound service can be changed without unbinding it first.
Available to organization administrators and, for partners, in the MSP Portal.
Improved
The services list in the MSP Portal shows support information for a service in one place, laid out in sections and naming the cloud the service runs in.
Changed
The card was headed "Logins Today", which read as logins since midnight. It has always counted a rolling 24 hour window, and the heading now says so. The number itself is unchanged, but a report built on the old wording was measuring something else than it claimed.
Improved
The admin console shows the incoming request as it arrived, so an authentication that did not behave as expected can be inspected without taking a packet capture.
The device list searches across several fields at once, including the called station identifier, and shows a fuller description for 802.1X flows.
Improved
A registered device can be moved from one group to another from the admin console, so a device that ends up in the wrong group does not have to be removed and registered again.
Improved
The basic settings show the source host name that webhook deliveries come from, so it can be allowed through a firewall without guessing.
New
Every RADIUS authentication attempt is recorded with its outcome, and for a denial the specific reason: an unknown RADIUS client, a shared secret that does not match, an unregistered device, a user outside the expected group, or a configuration problem.
An attempt expands into a timeline of the decision points that led to the outcome, and the request and the response can be inspected as readable tables rather than raw text.
The log is filtered by time range, by decision and by free text, and it is embedded on the context and group pages as well as available on its own, so it can be reached from the device or group being investigated.
New
The portal's colours and imagery can be drawn from a website address instead of being set by hand, and the address is prefilled from the organization's own website when one is recorded.
Improved
When a session expires the page you were on is remembered, and you are returned to it after signing in instead of to the dashboard.
New
A partner role for staff who support customers day to day, without the rights that come with administering the partner itself.
New
A Service Gateway is configured from a framework template rather than field by field. The template carries variables, and the console shows which ones are unresolved and which custom variables are defined but never used, so a template can be checked before it is applied.
A template with unresolved variables cannot be downloaded, which is what previously produced a gateway configuration that looked complete and was not.
Creating a gateway also asks for less: IP and BGP settings are no longer required and fall back to defaults, and framework and BGP settings are edited in place instead of through separate dialogs.
Available to organization administrators and, for partners, in the MSP Portal.
New
A Dot1x context can admit a device by its MAC address when 802.1X does not complete, so headless equipment on the same SSID does not need a context of its own.
New
A site can define the address a guest is sent to once they are online, so the portal can hand over to a venue page or a booking system instead of the page the guest first tried to reach.
New
The email self-registration form can carry extra fields that you define, so a guest can be asked for what the venue actually needs, such as a room number, a company or a reason for the visit.
New
Quick Access, the one-click sign-in that asks a guest for nothing, can be given a limit on how many connections it admits, so an open network can be capped without switching to a login module that asks for an identity.
New
Each DHCP scope on a Service Gateway decides for itself whether it hands out Option 114, the captive-portal address that lets a device open the portal on its own instead of waiting for a redirect. The scope list shows the policy per scope.
New
An administrator is given roles at the level the access belongs to: on the organization, or on a single service context inside it. The same person can therefore administer one service while only reading another.
The partner side works the same way in the MSP Portal, with its own set of partner roles.
New
A customer is an organization, and each service it runs is a service context inside that organization. Sign In, EntryPoint, EasyPSK and Endpoint Manager are all created and administered the same way, under the same organization, instead of each living in its own structure.
One identity can hold roles in more than one organization and move between them without signing out, which is what lets a consultant or a partner employee work across several customers.
New
An organization can federate sign-in against its own identity provider on all three surfaces: the administration portal, the Self-Service portal, and the captive portal where a guest or employee signs in to the network.
Each surface is configured separately, so an organization can federate its administrators without federating its guests, or the other way around.
New
An organization can list the IP ranges its administrators sign in from, so the administration portal answers only from the networks you name.
Changed
Administrative changes are recorded the same way whichever service they concern, and read from one place, instead of each service keeping its own record in its own shape.
Webhooks follow the same model, so the events an integration subscribes to look alike across services.
New
Partners have their own portal, separate from the Administration and Self-Service portals that customers use. It is where a partner provisions and manages the organizations it serves, and follows their usage and support.
Improved
The overview lists every Cisco ISE endpoint group, supports search by name, and shows how many endpoints each group holds.
Improved
The endpoint overview covers every Cisco ISE endpoint and can be searched by MAC address.
New
The dashboard now reports the number of Cisco ISE endpoint groups, the number of endpoints, how many groups are connected, and how many Self-Service Users exist.
New
Administrators can create a new Cisco ISE endpoint identity group without leaving the admin console.
Improved
All Cisco ISE endpoint groups and endpoints can be inspected without bringing any group under management first.
Changed
The flow used to be described as creating a group, which suggested the platform made something new in Cisco ISE. It does not. It connects a group that already exists.
Changed
The address shown for an endpoint is the one Cisco ISE reports through its own API rather than one derived from session data, so the console and Cisco ISE agree.
Changed
The previous labels, managed and unmanaged, said less about what the state actually meant.
New
Endpoints can be moved from one group to another, and a group can be exported as a CSV file.
A Change of Authorization is triggered automatically when endpoints are added, removed, updated or moved, so Cisco ISE re-evaluates them without waiting for the next natural re-authentication.
New
Administrators can ask Cisco ISE to re-authenticate an endpoint on demand.
New
Batch upload is available in both the admin console and the Self-Service portal.
Improved
The email a Self-Service User receives explains what they have been given access to and how to reach it.
New
A service context declares which Cisco ISE endpoint custom attributes are available to the groups under it, so only the attributes you intend to manage can be applied to endpoints.
New
A value set on a group is written to every endpoint in it, whether the endpoint was added by an administrator or through self-service, and a scheduled verification keeps them consistent.
The clearest use is Identity PSK, where every endpoint in a group is meant to carry the same key.
New
EntryPoint can forward an authentication request upstream to a remote RADIUS federation instead of answering it itself. This is what an organization taking part in eduroam needs, and it is configured as a variant of an EntryPoint context like the others.
New
Webhooks are no longer tied to one service. Every service can publish its events, and which webhooks an administrator may see and change follows their roles.
A delivery is inspectable: the console shows which endpoint was called, which event types the delivery carried, and whether it succeeded. Events raised while a webhook is switched off are held rather than lost, and the console says plainly that the webhook is disabled.
Sign In session events are covered in full, and events can be delivered in batches instead of one request per event.
New
The people on a Password module subscription list are emailed when a new password takes effect, so reception staff and hosts do not have to look it up. The notification can also be sent again on request.
New
A context can authenticate equipment on a certificate that names the device rather than the user, which is what company-owned laptops and headless gear issued from a customer PKI need.
New
An endpoint shows whether it is currently connected, in the admin console and in the Self-Service portal, together with what it is connected to.
The admin console gained a detail list for the endpoints in a group with an action menu per row, and a service context can be given a description of its own.
The console also checks up front whether the API account is allowed to read session data, instead of failing later without explaining why.
New
A context can be divided into sites, and an access policy can defer its redirect to the address configured for the site the guest is actually at. One policy then sends guests to different places depending on where they connected.
Changed
The RADIUS client secret is held separately for each service instead of being shared, so a secret can be rotated for one service without disturbing the other.
New
A delegated administrator can manage the devices and members of a Meraki WPN group from the Self-Service portal, without an account in the admin console.
New
Devices can be uploaded to an iPSK group from a file instead of being added one at a time.
New
Each service carries its own set of administrator roles, so access can be granted for one service without granting it for the others an organization happens to run.
Changed
Personal accounts are administered on the group rather than centrally, which is what makes it possible to delegate a group without handing over every account in the context.
Self-service enrollment moved onto the group's Self-Service tab at the same time, next to the other delegation settings.
New
How long login records, session history and device data are kept is set per service context, under Administration and Compliance. The shortest period that can be configured is one day.
Terms and privacy policy are handled separately from each other at the same time, so one can be changed without touching the other.
New
An Attribute Profile defines the network policy returned on a successful authentication, such as a VLAN through tunnel attributes or a Cisco security group tag. Profiles are defined once and reused across groups, so the same policy does not have to be typed out per group.
New
A context can authenticate users on a certificate issued through Microsoft Entra ID, with the certificate settings configured in the console and group membership checked against Entra at each authentication.
New
An existing Cisco ISE endpoint identity group can be brought under management from the platform, and administered without anyone signing in to Cisco ISE. A group can also be pointed at a different context later without being recreated.
Endpoints carry attributes written onto the Cisco ISE record, including their device type, and the console keeps an audit of what was changed and validates the connection settings before saving them.
Delegated administration came with it: the people who own the equipment manage their own endpoints from the Self-Service portal.
A Cisco ISE API status card reports whether the platform can reach the deployment, and a service context carries a connection name of its own so several can be told apart.
Improved
The RADIUS settings a Cisco Meraki network needs for MAC-based authentication and for the splash page are presented together, so the values to enter in the Meraki dashboard can be read off in one place.
Improved
A full pass over the portal: a dark mode that covers the whole interface, a search field on the device lists, a table view for devices as an alternative to cards, and icons that distinguish wired from wireless at a glance.
Keys are masked in the connect instructions until asked for, a device list can be reloaded without leaving the page, and a Wi-Fi QR code prints properly.
New
A Meraki integration carries a group policy and an access policy strategy, set when the integration is added and changeable afterwards. The group policy can be changed where the strategy is a shared one, and the Meraki API user can be updated without recreating the integration.
New
DHCP activity is recorded and can be downloaded, and the lease history for a single device is shown on that device in the console, so an address can be traced back to the equipment that held it.
No entries for that service yet.
