Drag and Drop Question Refer to the exhibit. An engineer must configure SAML single sign-on in Cisco ISE to use Microsoft Azure AD as an identity provider. Drag and drop the steps from the left into…

Question

Exhibit

Answer Area

Explanation

SAML SSO Configuration: Cisco ISE + Azure AD

The Core Logic

SAML SSO configuration follows a outside-in, provider-first pattern: you must establish the identity provider (Azure AD) before the service provider (ISE) can reference it. Each step depends on artifacts produced by the previous step.

Step-by-Step Breakdown

1. Configure Azure AD IdP Settings

Azure AD must be set up first because it is the authoritative identity provider. This step registers Cisco ISE as an enterprise application in Azure AD and defines the SAML claims, entity IDs, and assertion attributes. Nothing in ISE can reference Azure AD until Azure AD knows ISE exists.

2. Upload Metadata from Azure AD to ISE

After Azure AD is configured, it generates an XML metadata file containing its public signing certificate, SSO URLs, and entity descriptor. This file is the handshake artifact - ISE needs it to trust and communicate with Azure AD. You cannot configure the ISE IdP settings without this metadata, because those settings are largely derived from it.

3. Configure SAML Identity Provider on ISE

With the Azure AD metadata imported, ISE now has the information needed to define the SAML IdP relationship. This step binds Azure AD as the trusted IdP within ISE, mapping the metadata to an ISE authentication policy node.

4. Configure SAML Groups on ISE

This is the last step because group mapping is an authorization concern, not an authentication one. SAML groups (sent as attributes in the SAML assertion from Azure AD) must be mapped to ISE identity groups for role-based access control. You must have a working IdP configuration before group attributes can be meaningfully mapped.

Common Mistakes

• Skipping step 1 and starting in ISE: ISE requires Azure AD metadata to exist before you can configure the IdP - you have nothing to import if Azure AD isn't configured yet.
• Treating steps 2 and 3 as interchangeable: Step 3 depends on the metadata from step 2. Attempting step 3 first leaves ISE with no signing certificate or endpoint URLs to configure against.
• Placing group configuration early: Groups are authorization policy, not identity trust. Configuring groups before the IdP trust is established has no effect and may reference objects that don't yet exist in the policy model.

No community discussion yet for this question.