Changelog

1.0.0 August 18, 2026

Tested versions: link

New Features:

Add support for endpoint custom attributes via identity_management.endpoint_custom_attributes, which can then be assigned to individual endpoints through custom_attributes
Add support for custom_attributes on internal users
Add SNMPv3 support for network devices via the snmp.username, snmp.security_level, snmp.auth_protocol, snmp.auth_password, snmp.privacy_protocol and snmp.privacy_password attributes
Add dictionary_value support to Network Access and Device Admin policy conditions
Make the internal user password attribute optional

Breaking Changes:

Endpoints now reference a profiling policy by name via profile_name instead of the raw profile_id. The name is resolved to a profile ID automatically through the ise_profiler_profile data source. Replace profile_id: "<uuid>" with profile_name: "<Profiler Policy Name>" for any endpoint using static_profile_assignment: true
Authorization profile advanced attributes now use an explicit dictionary_value key for dictionary references (AdvancedDictionaryAttribute) instead of inferring intent from colons in value. value is now always a literal AttributeValue (colons preserved, so value: "shell:priv-lvl=15" no longer needs a special-case pattern). To configure a dictionary reference, replace value: "Dictionary:attribute" with dictionary_value: "Dictionary:attribute". The attribute_value_patterns workaround has been removed

Bug Fixes:

Fix duplicate Terraform key error when defining multiple network device groups under the built-in Is IPSEC Device container link
Fix conditions with circular references losing their children on every plan by splitting condition creation into two phases, leaf conditions first and parent conditions second link
Fix incorrect network device group paths under the Is IPSEC Device hierarchy caused by ndg_type_map merge order, which produced a perpetual plan diff for devices in that hierarchy link
Fix perpetual plan drift on active_directory_join_point by ignoring groups, which are managed separately by ise_active_directory_add_groups link
Fix SNMP settings being dropped for devices without a read-only community string. SNMP attributes were previously gated on snmp.ro_community, so an SNMPv3 device produced empty SNMP settings. snmp.version and snmp.username now activate SNMP settings as well
Fix forced replacement of Active Directory join points by removing the aging_time default and allowing aging_time: 0 in the join point schema
Fix dictionary attribute data_type enum values to match the ISE API, which expects IPV4 and IPV6 in uppercase
Fix condition name validation so that names containing spaces are accepted

Tested versions: link

Add support for TrustSec Multiple Matrices (requires Cisco ISE 3.4 Patch 2 or above)
Add support for extended policy condition nesting from 3 to 7 levels (1 root + 6 nested children) for all 12 Network Access and Device Admin policy resources
Add automatic profiler profile ID lookup for EndPointPolicy conditions in authorization rules
Fix issue with missing certificate_authentication_profile field in identity source sequences when field is not defined in YAML
Add support for network device group references in TrustSec IP-SGT mappings and mapping groups with proper ID resolution
Add support for network device references in TrustSec IP-SGT mappings and mapping groups with proper ID resolution
Add deploy target resolution that selects between network devices (ND), network device groups (NDG), or all devices (ALL) based on deploy_type attribute in IP to SGT mapping and IP to SGT mapping groups
Add support for network access dictionary attributes
Fix support for custom network device group type names using single-segment path
Fix issue with circular condition references causing failures on fresh deployments
Fix issue with policy set rule ranking when Default policy set is used

Tested versions: link

Fix Certificate Authentication Profile defaults and add proper support for username_from: UPN mode with Active Directory
BREAKING CHANGE: Active Directory groups field now requires object format with name field instead of string format
Add support for adding AD groups using name and SID without domain join and lookup
Fix issue where *_eap_tls_auth_of_expired_certs attributes in allowed protocols were incorrectly set to false instead of null when parent EAP-TLS method is disabled, causing ISE API validation errors (PEAP, EAP-FAST, TEAP)
Add support for optional Active Directory join operation with join_domain flag, allowing creation of join points and addition of groups without executing join
Add support for automatic TrustSec policy push (SGTs, SGACLs, and egress matrix) to network devices with configurable push_mode (AUTO/DISABLED)
Add support for shell profile av-pairs under authorization profiles

Tested versions: link

Fix issue with Cisco AV pairs not working properly within an authorization profile
Fix issue with incorrect merging of authorization rules

Tested versions: link

Tested versions: link

Fix issue with unordered policy sets, authentication rules, authorization rules, authorization global exception rules, and authorization exception rules under network access and device administration
BREAKING CHANGE: Rename trustsec_download_enviroment_data_every_x_seconds attribute to trustsec_download_environment_data_every_x_seconds in Network Device data model
Fix issue with incorrect generated ranks in multiple policies link
Fix update-in-place during import of user identity group, endpoint identity group, network device group, device admin condition, device admin time and data condition, device admin policy set, network access condition, network access time and date condition and network access policy set

Tested versions: link

Add parent_group attribute to user_identity_group
Support new *_update_rank resources to allow changing the rank of policy sets or rules without impacting existing configurations
Support active directory configurations without groups
Added support for managing endpoints
Added support for default user identity groups assignment under internal users
Fix incorrect description attribute of network_device_groups configuration
BREAKING CHANGE: endpoint_identity_groups and user_identity_groups now support nested children in favor of parent references

Tested versions: link

Fix issue with error due to missing settings for allowed_protocols and EAP-TLS stateless session resume
Add support for active directory configuration
Added ise_identity_source_sequence support
BREAKING CHANGE: Split attribute_name to dictionary_name and attribute_name
BREAKING CHANGE: Removed manage_* Terraform module variables
Allow updating default policy sets and rules

Tested versions: link