A Cisco ISE administrator needs to ensure that guest endpoint registrations are only valid for 1 day. When testing the guest policy flow, the administrator sees that the Cisco ISE does not delete…

A RADIUS policy allowing repeated authentication does not explain why an endpoint remains registered and grants access beyond its intended validity period, as the core issue is the endpoint itself not being purged.

If the length of access in Guest Portal Settings was set to 7 days, it would directly extend access, but the problem description implies an intended 1-day validity is being bypassed because the endpoint is not deleted, pointing to a purge policy.

The Endpoint Purge Policy in Cisco ISE dictates when endpoint entries, including those of guest devices, are removed from the identity store. If this policy is set to 30 days for guest devices, even if a guest account's validity is 1 day, the endpoint registration itself will persist for 30 days, potentially allowing the device to re-authenticate or be recognized even after the initial guest account expires.

The Guest Account Purge Policy controls when the guest user accounts are deleted from ISE, not the associated endpoint registrations in the Guest Endpoints identity store. A guest account might be purged, but if the endpoint is not, it could still be recognized.