Managed Attributes

Managed Attributes are how Endpoint Manager for Cisco ISE handles Cisco ISE’s Endpoint Custom Attributes — the arbitrary fields your ISE deployment can expose for authorization, audit, or reporting.

This page covers the definitions: what an attribute is and how you create one. Setting values is a separate job on the group, see Attribute values on a group. Attributes that hold a Wi-Fi key have their own page, Identity PSK.

Two levels

Every attribute is defined at one of two levels, and the level decides where its value lives.

Level	Value set	Suits
Group Level	Once on the group, applied to every endpoint in it	Data that is uniform across the group: vendor ownership, site code, a policy tag, a maintenance window
Endpoint Level	On each device, when it is added or edited	Data that differs per device: asset ID, end date, owner, a device key

The level is decided by which sub-tab you create the attribute from, and it is locked afterwards. The edit dialog shows it as a read-only Attribute Level field with the note “The level cannot be changed — remove the attribute and add it again.”

So an attribute is group managed or endpoint managed, never both. There is no override relationship between the levels and no case where a group value and an endpoint value compete for the same field. A group can manage any number of attributes at each level at the same time; the only either-or rule concerns Identity PSK.

Prerequisite — the attribute must exist in Cisco ISE first

Every attribute you define must already exist as an Endpoint Custom Attribute on your Cisco ISE deployment, under Administration → Identity Management → Endpoint Custom Attributes. The platform never creates it there.

Warning

Cisco ISE discards values for names it does not recognise, and returns no error while doing it. An attribute whose name does not match one on the ISE side will save on the platform, look correct in every view, and never reach the endpoint. Check the spelling against Cisco ISE before you rely on a value.

Managed Attributes tab — one sub-tab per level, each with its own Add Attribute button.

Defining an attribute

Open the Context’s Configuration → Managed Attributes tab and pick the sub-tab for the level you want: Group Managed Custom Attributes or Endpoint Custom Attributes. Press Add Attribute there. The form has three sections.

Identity

1. Attribute Name

   Exactly as it is spelled on the Cisco ISE side. Must start with a letter, may contain letters, digits, underscores and hyphens, and may be up to 64 characters. Unique within the Context, and immutable once created.

   Names beginning with ng are reserved for platform attributes and are rejected.

2. ISE Type

   Must match the type defined in ISE, and is immutable once created:

   • String — any text value.
   • Integer — whole number.
   • Boolean — true / false.
   • Float — decimal number.
   • Long — big whole number.
   • IP Address — IPv4. IPv6 addresses are rejected.
   • Date — a date, with no time of day.

3. Display Name

   Optional. Shown to readers instead of the raw attribute name, so asset-id can appear as Asset ID.

   This is the only label field. There is no free-text description on an attribute; descriptions live on the individual options of a dropdown.

Behavior

Input decides the control a person gets, which is not the same thing as the ISE type. A field can be stored as a String in Cisco ISE and still be presented as a dropdown of four approved values.

Input	What the user gets
Text	Free text
Integer	Whole number
Decimal	Decimal number
Toggle	An on/off switch, stored as true / false
IP Address	An IPv4 field
Date	A date picker, date only
Dropdown	A list of values you define
iPSK PSK	A Wi-Fi key the platform generates and rotates

Not every pairing is valid. The ISE type constrains the inputs:

ISE Type	Inputs allowed
String	All eight
Integer, Long	Text, Integer, Dropdown
Float	Text, Decimal, Dropdown
Boolean	Text, Toggle
IP Address	Text, IP Address, Dropdown
Date	Text, Date, Dropdown

An iPSK PSK attribute must be typed String in Cisco ISE.

Required makes a value mandatory when a device is added. It is available on endpoint level attributes only, and never on a Toggle, which always carries a value, nor on a key, which the platform generates.

Note

Batch upload cannot carry attribute values. If a group uses batch adding, don’t mark its endpoint attributes Required.

Exposure

Exposure decides what a Self-Service User sees. The attribute is always visible to you in the admin console regardless of this setting.

Setting	In the Self-Service portal
None	Not shown. Admin-only
Display	The value is visible on the user’s devices, read-only
Editable	The user can also set the value when adding or editing their own devices

Editable requires an endpoint level attribute. On a group level attribute the option is disabled, with the note “Requires an endpoint level attribute — group level values are managed by admins.”

Two things must both be true before a Self-Service User sees an endpoint attribute: exposure is not None, and the group has opted in to the attribute.

Dropdown options

Press Edit Options on a dropdown attribute. Each option carries a Value, a Description and an optional Icon. The dialog states the split plainly: “The stored value is exactly what is written to Cisco ISE — the description is what the user sees.”

That lets the stored value stay machine-friendly while the reader gets something meaningful. Values must be unique, non-empty and valid for the ISE type, and they are matched exactly, including case.

Device Type — the one system attribute

The platform seeds a single system attribute into every Context: Device Type, an endpoint level dropdown with a curated list of options and icons, Editable in Self-Service, and pre-selected on every group.

Device type used to be a fixed field in both portals. It is now an ordinary endpoint attribute driven by this definition, which is also why the icons in device lists come from the attribute’s options.

Its name, ISE type, level and input are fixed and it cannot be removed. Its options, its Required flag, its Display Name and its Self Service setting are yours to change. The ng prefix reservation exists so your own attributes can never collide with a platform one.

Removing a definition

Remove an attribute with the action on its row. A definition still in use by a group is refused until you remove it from the groups first, and the system attribute cannot be removed at all.

Removing a definition stops the platform managing that attribute going forward. It does not clear the values previously written into ISE — the confirmation dialog says so.

Common attribute shapes

Attribute	Level	Input	Purpose
vendor-owner	Group	Text	Name of the vendor managing the fleet; read by reports and SIEM
maintenance-window	Group	Text	When it’s OK to reboot or re-configure
security-group-tag	Group	Dropdown	SGT name ISE applies; drives microsegmentation
asset-id	Endpoint	Text	The asset register’s identifier for this specific device
end-date	Endpoint	Date	When the device should stop being allowed on
owner	Endpoint	Text	Who is responsible for this device
vlan-id	Either	Integer or Dropdown	VLAN assignment for MAB authorisation

Note

The platform never acts on a value. An end-date attribute expires nothing by itself. It becomes meaningful only through an authorization rule you write in Cisco ISE, for example one that admits a device only while its end date is in the future. The platform’s job is to keep the value accurate and in the right place.

Related

Attribute values on a group

Set group values, and pick which endpoint attributes the group uses.

Identity PSK

Attributes that hold a Wi-Fi key, shared or per device.

Managing endpoints

Where endpoint level values are entered.

Change of Authorization

Force a re-evaluation after an attribute change.