Cisco ISE uses endpoint MAC addresses to save and manage data, display context visibility information, and enable authorization workflows.

For VPN-connected endpoints, the VPN headend receives an endpoint’s MAC address, Unique Device Identifier (UDID), or both from the Cisco Secure Client (formerly known as Cisco AnyConnect). It then sends the information to Cisco ISE over RADIUS communication.

When you integrate Cisco ISE with an MDM server, Cisco ISE uses either the endpoint's MAC address or the UDID to query the MDM server for the endpoint’s registration, compliance status, and other MDM attributes.

When Cisco ISE queries an MDM server with endpoint's UDID, the MDM server usually responds with the endpoint's MAC address. Receiving an endpoint's MAC address from either the Cisco Secure Client or the MDM server is critical for Cisco ISE. Cisco ISE uses the MAC address to save and manage the endpoint data in its databases.