When configuring an Authorization Policy for BYOD, which condition should be used to ensure the device has successfully performed BYOD registration?
Trap 1: Endpoint:Profile EQUALS RegisteredDevice
Endpoints are profiled, but the registration status is a separate session attribute.
Trap 2: Session:RegistrationMode EQUALS Auto
This is not a standard attribute for verifying BYOD status.
Trap 3: Device:AccessType EQUALS BYOD
This is not a valid attribute condition.
- A
Session:BYODRegistrationStatus EQUALS Registered
Session conditions in Cisco ISE evaluate live session attributes, and BYODRegistrationStatus is populated during posture or registration flows. Matching it EQUALS Registered confirms the endpoint completed onboarding before authorisation, directly satisfying the stem's requirement that BYOD registration succeeded. RADIUS-based identity conditions cannot expose this state, so the session dictionary is the only accurate source.
- B
Endpoint:Profile EQUALS RegisteredDevice
Why it fails: Endpoints are profiled, but the registration status is a separate session attribute.
- C
Session:RegistrationMode EQUALS Auto
Why it fails: This is not a standard attribute for verifying BYOD status.
- D
Device:AccessType EQUALS BYOD
Why it fails: This is not a valid attribute condition.