ISE Posture Assessment: Healthy Devices Only

By Taylor Thomas · 2026-08-30

A successful 802.1X authentication establishes that the presented credential was one the authentication server accepted. What it does not ordinarily establish is the endpoint’s current health: nothing in it says whether the laptop has anti-malware running, a patched operating system, or an enabled firewall. A compromised machine can still authenticate on otherwise valid credentials — the method judges the authentication evidence, not the device’s condition. Posture assessment is the control that narrows this gap: Cisco ISE evaluates the endpoint’s state against configured health policy and lets authorization reflect what the device shows, not just what the identity is entitled to.

Status Drives Access

ISE tracks a posture status for each session, and the model is easiest to hold as three states. Unknown means ISE holds no currently valid posture determination for the endpoint — where a first assessment begins, though a still-valid recent result can carry over instead. Compliant means the endpoint’s reported state satisfied the posture requirements that applied to it. NonCompliant means at least one mandatory requirement went unsatisfied. Authorization policy matches on this status, which is the whole mechanism in one sentence: the status changes, so the access policy assigns can change with it.

The sequence runs in stages. The endpoint gains initial access — through 802.1X authentication or MAB — and, with posture Unknown, typically lands in the limited authorization assigned to that status: commonly enough access to reach the client provisioning portal and the posture infrastructure, with a redirect steering the browser toward provisioning if no agent is present. The endpoint’s state is collected and reported. ISE evaluates the report against policy and updates the session’s status. Then a RADIUS Change of Authorization — the CoA mechanism defined in RFC 5176 — prompts the network access device to apply new authorization or run a fresh authentication, depending on the CoA type configured — provided the device supports and is configured for CoA, which posture enforcement depends on. In the usual 802.1X or MAB flow that happens without the user manually disconnecting or reconnecting; whatever effort the flow demands of the user lives earlier, in provisioning or remediation. The network ends up with a session whose privileges match the device’s measured state.

Agents, Conditions, Remediation

Posture needs eyes inside the endpoint, and collection happens there. The persistent option is the ISE Posture module of Cisco Secure Client (the successor to AnyConnect), which stays resident on managed endpoints and carries the broadest feature set — exactly what it supports varies by ISE release, client release, and operating system. The lighter option is the Temporal Agent, which runs a one-time assessment without a permanent install, and carries a narrower feature set in exchange. And on ISE 3.0 and later, agentless posture removes the installed-module requirement for populations that meet its prerequisites: ISE temporarily places a dissolvable assessment package on the endpoint using administrative credentials over a supported management protocol, executes the checks, collects the result, and removes it — no resident module and, in the supported workflow, no user portal interaction.

What gets checked is expressed as posture conditions: the presence and state of anti-malware, supported operating-system update checks, firewall status, required files, services, or applications, disk encryption, and similar endpoint-health attributes. Conditions compose into requirements, and requirements attach to posture policy that scopes them — by operating system, identity group, or other session attributes — so the Windows fleet, the macOS fleet, and the contractor population can each be measured against their own bar. In the admin interface, the Posture Work Center gathers this configuration into one workflow.

Failing the bar is designed to be recoverable. A NonCompliant endpoint can be authorized into remediation access — confined to the update servers and portals needed to fix what failed. How much of the fixing is automatic, and where the user sees instructions — in the Secure Client interface, a portal, or not at all — depends on the collection method, the operating system, and the condition; the persistent client supports the most, the lighter methods less. The goal is a loop that ends in Compliant, not a help-desk ticket. Where policy allows a check to be optional rather than mandatory, a failure can warn without blocking — a way to phase posture in without a day-one support storm.

Compliance Is a Moment; Health Is Ongoing

A device that passed at 9:00 can be out of policy by lunch — anti-malware disabled, a service stopped. Posture accounts for that too: periodic reassessment, where the collection method supports it, re-runs checks on an interval while the session stays up, so Compliant remains a statement about the most recent still-valid assessment rather than a badge earned once at the door. Whether to enforce on a mid-session failure or merely log it is a policy decision — the same observe-first, enforce-later sequencing that eases the initial rollout applies here.

Operationally, posture runs on the same ISE deployment personas as everything else — Policy Service Nodes carry the assessment traffic, which matters when sizing a deployment. And it earns its own domain on the certification path: Endpoint Compliance is a top-level domain of the SISE 300-715 blueprint, covering posture services, client provisioning, posture conditions and policy, and the Posture Work Center. If you can narrate the staged sequence above — Unknown, collect, evaluate, CoA, Compliant — you already hold the mental model that ISE’s broader access story builds on.

Frequently Asked Questions

How is posture different from profiling in ISE?

Profiling answers what a device is — camera, printer, workstation — from observed and, where probes are configured, actively queried attributes, and it works without any endpoint agent. Posture answers whether an endpoint met its configured posture requirements at the latest still-valid assessment, and it needs endpoint-state collection — an agent, or the agentless script mechanism — to inspect things like anti-malware, updates, and firewall settings. They answer different questions and commonly work together: profiling can inform which devices authorization policy subjects to posture at all.

What happens to a user while their device is being assessed?

They are on the network, but in a deliberately limited authorization. While the session's posture status is Unknown, policy typically grants just enough access to reach the provisioning portal and the posture infrastructure. Once the endpoint's state is reported, ISE evaluates the result and sends a Change of Authorization so the network device applies the new authorization — or triggers a reauthentication that ISE then evaluates fresh. Commonly that means full access on Compliant and remediation access on NonCompliant, though the mapping is the administrator's to define — all without the user unplugging or manually reconnecting.

Does posture require installing software on every endpoint?

Not on every one. Managed endpoints needing the broadest posture, remediation, and reassessment capabilities commonly use the persistent ISE Posture module of Cisco Secure Client. Where a permanent install is not acceptable, the Temporal Agent runs a one-time assessment without staying resident, with a narrower feature set — and ISE 3.0 and later add agentless posture, which runs a dissolvable script on supported endpoints using administrative credentials, subject to its own OS, connectivity, and privilege prerequisites. Deciding which population gets which treatment — and which is exempt entirely — is part of posture policy design.