username for ISE to add/remove mac addresses entries

[Noovi]

Hi Guys,

I am working on ISE 2.2 version. We are regularly adding/removing MAC addresses of phones into ISE endpoints group for authentication purpose.

Can we create one user profile that will have only minimal access to ISE like addition of MAC entries and ISE reporting purpose?

[Damien Miller · Accepted solution]

You can create a local user in ISE or map an ldap/ad group to the Identity Admin group. This role should have the permissions you want, or close at least. 

[ajc · Accepted solution]

Check the following sequence of screenshots, you need an ADMIN GROUP which is related to an AD Group with the limited access to ISE Menu. That Group would be allowed some specific menu options/data. Finally you create a Policy so when you login into ISE the policy is applied and the restricted menu access is applied.