An administrator must change the authentication method from local accounts to SAMIL for wireless guest users in a Cisco ISE deployment. Using the SAML protocol, the guest portal must be configured…

Creating employee accounts in the Sponsor portal is unnecessary because SAML offloads authentication entirely to the external identity provider, eliminating the need for locally managed guest accounts.

Creating a SAML identity provider in ISE is already completed - importing the IdP metadata into the ISE SAML identity provider profile constitutes creating and configuring that provider.

Configuring the Sponsor portal is not required for SAML authentication; the Sponsor portal handles guest account sponsorship and lifecycle management, not authentication method assignment.

The secondary self-registered guest portal created specifically for SAML integration must have the SAML identity provider selected as its authentication method in the portal settings, so that users are redirected to the external IdP for credential validation.

The primary guest portal for wireless guest users must also have the SAML identity provider configured as its authentication method, because each portal independently requires this binding to route authentication requests to the external identity source.