01
MAC address management
Organize non-802.1X devices by MAC group for simpler onboarding and efficient management.
Your network team owns the policy. The vendors own their devices.
Cisco ISE keeps doing what it does best — 802.1X, MAB, iPSK, profiling, authorization policies. Endpoint Manager sits next to ISE, not in front of it, and hands per-group endpoint administration to the people who actually own those devices.
The telephony vendor manages IP_Phones. The security
contractor manages Cameras. The AV integrator manages
Conference_Room_Displays. None of them log in to ISE.
No ISE seats handed out. No tickets to add a new printer. No quarterly access review chaos.
Why ISE alone isn't enough.
We have around 4,200 medical devices across seven sites. Every infusion-pump swap used to sit in our ISE backlog for two weeks. The network team had basically become a data-entry function.
We couldn't hand helpdesk an ISE login — the audit risk was too high — but they were still first in line every time a port got blocked. Tickets sat over weekends. Security blocked service.
Twelve contractors emailing MAC addresses to a shared inbox. Every Friday afternoon disappeared into registration tickets. The network team dreaded month-end and quarterly reviews.
An IPSec tunnel straight to your firewall. No exposed ISE.
Netgraph establishes a Connector tunnel from our cloud to your firewall. The Cisco ISE API never leaves your perimeter. Granular rules in the tunnel scope what we can call.
Enterprise
Cisco ISE
API Gateway - CONTRACTOR-ABB
- SIEMENS-OT
- CAVERION-CCTV
- ASSA-LOCKS
Customer
Firewall
IPSec Firewall
IPSec tunnel
Netgraph Cloud
Cloud
Connector
IPSec Connector
Endpoint Manager
- CONTRACTOR-ABB
- SIEMENS-OT
- CAVERION-CCTV
- ASSA-LOCKS
Self-Service
- User 1 CONTRACTOR-ABB
- User 2 SIEMENS-OT
- User 3 CAVERION-CCTV
- User 4 ASSA-LOCKS
Everything a delegated administrator needs. Nothing they shouldn't.
02
Bulk import of endpoints
Onboard hundreds of devices at once via CSV — save time and reduce manual effort.
03
Localize endpoints
Track device location and live status — online, offline, or session-active — straight from the portal.
04
SAML integration
Single sign-on with SAML for secure, seamless access to admin and self-service portals.
05
Role-based access control
Granular roles control who can manage endpoints, invite users, or configure group settings.
06
Identity PSK management
Rotate Wi-Fi keys from the self-service portal: one shared key for a group, or a unique key on every device. No ISE login needed.
07
Self-service portal
Group administrators add, remove, and edit their own devices — see who's connected, where, and how much traffic.
08
Endpoint custom attributes
Carry VLANs, SGTs, asset numbers and end dates on the endpoint record, per group or per device, for your ISE policy to read.
Two surfaces. One delegation model.
Network admins manage Endpoint Identity Groups, contexts, and API integrations from a single dashboard. Group administrators see only their devices — on whatever screen they happen to be on.
Per-endpoint attributes
Write the fact once. Let Cisco ISE act on it.
Facts that hold for a whole group belong on the group. What differs from one device to the next belongs on the device. Asset numbers, end dates, owners, a VLAN: Endpoint Manager writes them onto the endpoint record inside your Cisco ISE, where your own authorization policy can read them.
-
Reconcile against the asset register
Every device carries the identifier your CMDB already knows it by, kept current by the people who own the hardware rather than by a ticket to the network team.
-
Expire access on a date
An end date on the device, and one authorization rule in Cisco ISE that admits it only while that date is still ahead. Netgraph keeps the date accurate. Cisco ISE decides what it means.
-
Segment by device, not by group
A VLAN or an SGT on the individual endpoint, so a single Endpoint Identity Group can hold devices that are meant to land in different places.
- asset-id
- IT-04812
- asset register
- end-date
- 2026-11-30
- feeds the rule
- owner
- Facilities
- who to call
- vlan-id
- 240
- authorization profile
- site
- Kista HQ
- where it lives
Your authorization rule, in Cisco ISE
end-date is in the future
→ Permit Netgraph keeps the values accurate and in the right place. Cisco ISE decides what they mean.
One Cisco ISE. Many delegated groups.
Each Endpoint Identity Group in your Cisco ISE can be opted in to managed administration and handed to the right Group Administrator. They see only their group, and never log in to ISE.
IP_Phones
Managed by · Telephony vendor
Cameras
Managed by · Security contractor
Conference_Room_Displays
Managed by · AV integrator
Digital_Signage
Managed by · Marketing agency
Distributed administration, centrally controlled.
0
ISE seats handed to delegated administrators
1
IPSec tunnel from Netgraph to your firewall
N
Endpoint Identity Groups managed by their actual owners