A network engineer is configuring a new certificate template on the internal CA within Cisco ISE to provision certificates to BYOD devices that must be enrolled in the network. What must be…

For BYOD devices in Cisco ISE, especially when performing certificate-based authentication (e.g., EAP-TLS), the device's MAC address is often used as a unique identifier. Including the MAC address in the SAN field allows ISE to correlate the presented certificate with the device's identity registered during the BYOD onboarding process.

An email address is typically associated with a user, not a unique device identity for network access control purposes like BYOD device identification.

A user principal name (UPN) is associated with a user identity, primarily in Active Directory, and is not a standard unique identifier for a device in the context of network access control.

While the common name (CN) can identify the device, the SAN field is designed to hold multiple alternative identities, and using the MAC address specifically in the SAN is a common and recommended practice for device identification in BYOD scenarios with certificates.