A router is being configured for IKEv2 AnyConnect using AnyConnect-EAP. How would the administrator separate profiles for administrators and employees so that authorization differs when they connect?

Group aliases are a feature specific to Cisco ASA SSLVPN tunnel groups, not a supported mechanism for IKEv2 AnyConnect-EAP profile selection on IOS routers.

Group-URLs are used in ASA clientless and AnyConnect SSLVPN configurations to select tunnel groups, and are not applicable to IKEv2-based AnyConnect deployments on IOS.

Certificate maps apply when clients authenticate with certificates; since AnyConnect-EAP is being used for authentication in this scenario, certificate fields are not available for profile matching.

IKEv2 with AnyConnect-EAP uses key-ids as identifiers embedded in the IKEv2 IDr payload to distinguish which profile a client is using. By defining separate key-ids on the headend and creating two different AnyConnect XML profiles - each referencing the appropriate key-id - the router can apply distinct authorization policies for administrators versus employees. This is the correct method when certificate-based differentiation is not available because EAP is handling authentication.