Location in GUI : Work Centers » Device Administration » Device Admin Policy Sets
Name Type Constraint Mandatory Default Value name String Regex: ^[\w\d_\-\. ]+$ No description String No state Choice enabled, disabled, monitorNo enabledcondition Class [condition]No is_proxy Boolean true, falseNo falseservice_name String Yes
Name Type Constraint Mandatory Default Value type Choice ConditionReference, ConditionAttributes, ConditionAndBlock, ConditionOrBlockYes is_negate Boolean true, falseNo falsedictionary_name String No attribute_name String No operator Choice contains, endsWith, equals, greaterOrEquals, greaterThan, in, ipEquals, ipGreaterThan, ipLessThan, ipNotEquals, lessOrEquals, lessThan, matches, notContains, notEndsWith, notEquals, notIn, notStartsWith, startsWith, macContains, macEndsWith, macEquals, macIn, macNotContains, macNotEndsWith, macNotEquals, macNotIn, macNotStartsWith, macStartsWithNo attribute_value String No name String No children List [children]No
Name Type Constraint Mandatory Default Value type Choice ConditionReference, ConditionAttributes, ConditionAndBlock, ConditionOrBlockYes is_negate Boolean true, falseNo dictionary_name String No attribute_name String No operator Choice contains, endsWith, equals, greaterOrEquals, greaterThan, in, ipEquals, ipGreaterThan, ipLessThan, ipNotEquals, lessOrEquals, lessThan, matches, notContains, notEndsWith, notEquals, notIn, notStartsWith, startsWith, macContains, macEndsWith, macEquals, macIn, macNotContains, macNotEndsWith, macNotEquals, macNotIn, macNotStartsWith, macStartsWithNo attribute_value String No name String No children List [children]No
Name Type Constraint Mandatory Default Value type Choice ConditionReference, ConditionAttributesYes is_negate Boolean true, falseNo dictionary_name String No attribute_name String No operator Choice contains, endsWith, equals, greaterOrEquals, greaterThan, in, ipEquals, ipGreaterThan, ipLessThan, ipNotEquals, lessOrEquals, lessThan, matches, notContains, notEndsWith, notEquals, notIn, notStartsWith, startsWith, macContains, macEndsWith, macEquals, macIn, macNotContains, macNotEndsWith, macNotEquals, macNotIn, macNotStartsWith, macStartsWithNo attribute_value String No name String No
Example-1 Adding a new Policy Set
This example defines a global device administration policy set within Cisco ISE. It creates a policy named “Global Policy” that is enabled. The policy applies to all devices where the “Location” attribute in the “DEVICE” dictionary equals “All Locations,” effectively targeting all device locations. The policy uses the “Device Profile 1” profile to govern device administration access and authorization for matching devices.
description : Global policy
type : ConditionAttributes
attribute_value : All Locations
service_name : Device Profile 1
Example-2 Adding Multiple Policy Sets
This example demonstrates how to configure multiple device administration policy sets within a single configuration. Each policy set has distinct criteria and applies different device administration services. The first policy set, “Global Policy,” targets all device locations and applies “Device Profile 1.” The second policy set, “User 1 Policy,” specifically controls access for a user named “User 1” based on the “UserName” attribute in the Network Access dictionary, applying “Device Profile 2.” This approach allows granular control over device administration policies by defining multiple sets with different conditions and services.
description : Global policy
type : ConditionAttributes
attribute_value : All Locations
service_name : Device Profile 1
description : Policy Set to control User 1 access
type : ConditionAttributes
dictionary_name : Network Access
service_name : Device Profile 2
Location in GUI : Work Centers » Device Administration » Device Admin Policy Sets
Name Type Constraint Mandatory Default Value name String Regex: ^[\w\d_\-\. ]+$ No description String No state Choice enabled, disabled, monitorNo enabledcondition Class [condition]No is_proxy Boolean true, falseNo falseservice_name String Yes
Name Type Constraint Mandatory Default Value type Choice ConditionReference, ConditionAttributes, ConditionAndBlock, ConditionOrBlockYes is_negate Boolean true, falseNo falsedictionary_name String No attribute_name String No operator Choice contains, endsWith, equals, greaterOrEquals, greaterThan, in, ipEquals, ipGreaterThan, ipLessThan, ipNotEquals, lessOrEquals, lessThan, matches, notContains, notEndsWith, notEquals, notIn, notStartsWith, startsWithNo attribute_value String No name String No children List [children]No
Name Type Constraint Mandatory Default Value type Choice ConditionReference, ConditionAttributes, ConditionAndBlock, ConditionOrBlockYes is_negate Boolean true, falseNo dictionary_name String No attribute_name String No operator Choice contains, endsWith, equals, greaterOrEquals, greaterThan, in, ipEquals, ipGreaterThan, ipLessThan, ipNotEquals, lessOrEquals, lessThan, matches, notContains, notEndsWith, notEquals, notIn, notStartsWith, startsWithNo attribute_value String No name String No children List [children]No
Name Type Constraint Mandatory Default Value type Choice ConditionReference, ConditionAttributesYes is_negate Boolean true, falseNo dictionary_name String No attribute_name String No operator Choice contains, endsWith, equals, greaterOrEquals, greaterThan, in, ipEquals, ipGreaterThan, ipLessThan, ipNotEquals, lessOrEquals, lessThan, matches, notContains, notEndsWith, notEquals, notIn, notStartsWith, startsWithNo attribute_value String No name String No
description : Global policy
type : ConditionAttributes
attribute_value : All Locations
service_name : Default Device Admin
Location in GUI : Work Centers » Device Administration » Device Admin Policy Sets
Name Type Constraint Mandatory Default Value name String Regex: ^[\w\d_\-\. ]+$ No description String No state Choice enabled, disabled, monitorNo enabledcondition Class [condition]No is_proxy Boolean true, falseNo falseservice_name String Yes
Name Type Constraint Mandatory Default Value type Choice ConditionReference, ConditionAttributes, ConditionAndBlock, ConditionOrBlockYes is_negate Boolean true, falseNo falsedictionary_name String No attribute_name String No operator Choice contains, endsWith, equals, greaterOrEquals, greaterThan, in, ipEquals, ipGreaterThan, ipLessThan, ipNotEquals, lessOrEquals, lessThan, matches, notContains, notEndsWith, notEquals, notIn, notStartsWith, startsWithNo attribute_value String No name String No children List [children]No
Name Type Constraint Mandatory Default Value type Choice ConditionReference, ConditionAttributes, ConditionAndBlock, ConditionOrBlockYes is_negate Boolean true, falseNo dictionary_name String No attribute_name String No operator Choice contains, endsWith, equals, greaterOrEquals, greaterThan, in, ipEquals, ipGreaterThan, ipLessThan, ipNotEquals, lessOrEquals, lessThan, matches, notContains, notEndsWith, notEquals, notIn, notStartsWith, startsWithNo attribute_value String No name String No children List [children]No
Name Type Constraint Mandatory Default Value type Choice ConditionReference, ConditionAttributesYes is_negate Boolean true, falseNo dictionary_name String No attribute_name String No operator Choice contains, endsWith, equals, greaterOrEquals, greaterThan, in, ipEquals, ipGreaterThan, ipLessThan, ipNotEquals, lessOrEquals, lessThan, matches, notContains, notEndsWith, notEquals, notIn, notStartsWith, startsWithNo attribute_value String No name String No
description : Global policy
type : ConditionAttributes
attribute_value : All Locations
service_name : Default Device Admin
Location in GUI : Work Centers » Device Administration » Device Admin Policy Sets
Name Type Constraint Mandatory Default Value name String Regex: ^[\w\d_\-\. ]+$ No description String No state Choice enabled, disabled, monitorNo enabledcondition Class [condition]No is_proxy Boolean true, falseNo falseservice_name String Yes
Name Type Constraint Mandatory Default Value type Choice ConditionReference, ConditionAttributes, ConditionAndBlock, ConditionOrBlockYes is_negate Boolean true, falseNo falsedictionary_name String No attribute_name String No operator Choice contains, endsWith, equals, greaterOrEquals, greaterThan, in, ipEquals, ipGreaterThan, ipLessThan, ipNotEquals, lessOrEquals, lessThan, matches, notContains, notEndsWith, notEquals, notIn, notStartsWith, startsWithNo attribute_value String No name String No children List [children]No
Name Type Constraint Mandatory Default Value type Choice ConditionReference, ConditionAttributes, ConditionAndBlock, ConditionOrBlockYes is_negate Boolean true, falseNo dictionary_name String No attribute_name String No operator Choice contains, endsWith, equals, greaterOrEquals, greaterThan, in, ipEquals, ipGreaterThan, ipLessThan, ipNotEquals, lessOrEquals, lessThan, matches, notContains, notEndsWith, notEquals, notIn, notStartsWith, startsWithNo attribute_value String No name String No children List [children]No
Name Type Constraint Mandatory Default Value type Choice ConditionReference, ConditionAttributesYes is_negate Boolean true, falseNo dictionary_name String No attribute_name String No operator Choice contains, endsWith, equals, greaterOrEquals, greaterThan, in, ipEquals, ipGreaterThan, ipLessThan, ipNotEquals, lessOrEquals, lessThan, matches, notContains, notEndsWith, notEquals, notIn, notStartsWith, startsWithNo attribute_value String No name String No
description : Global policy
type : ConditionAttributes
attribute_value : All Locations
service_name : Default Device Admin
