Integrate MDM and UEM Servers with Cisco ISE

PDF

Ivanti (previously MobileIron) UEM servers

Updated: February 6, 2026

Want to summarize with AI?

Log in

Overview

This section describes how to connect Ivanti UEM servers to Cisco ISE.

MobileIron is now part of Ivanti. At the time of writing, MobileIron continues to offer Unified Endpoint Management (UEM) solutions such as MobileIron Core (On-Premises) and MobileIron Cloud.

Cisco ISE release 3.1 leverages APIs through the BasicAuth framework to connect to MobileIron Core or MobileIron Cloud servers. It receives GUID values from these servers. Cisco ISE uses these GUID values instead of MAC addresses to identify endpoints. This process enables reliable authentication even when MAC Address Randomization is in use.

GUID-based authentication uses client certificates, also called X509 or Identity Certificates. To ensure certificates sent from MobileIron Cloud or MobileIron Core servers to Cisco ISE include GUID values, complete these tasks:

Configuration steps in Ivanti

To use GUID with Cisco ISE, ensure you have MobileIron Core 11.3.0.0 Build 24 or later.

In the MobileIron Cloud or MobileIron Core administrator portal:

  1. Create a user account and assign the required API permissions to it.

  2. Configure a Certificate Authority (CA).

  3. Configure an Identity Certificate to include GUID information.

  4. Upload root certificates or trusted certificates, as required.

  5. Configure a Wi-Fi profile.

Tip

  • If you have already connected MobileIron Cloud or MobileIron Core servers to your Cisco ISE release 3.1 and want to receive GUIDs from the connected servers, perform steps 3, 4, and 5, as required.

  • When you edit your existing Identity Certificate or Wi-Fi configurations, or both, MobileIron republishes the updated configurations to your managed devices that are connected.

  • Although MobileIron does not recommend using self-signed certificates or a local CA, this guide includes the steps for self-signed certificates and a local CA as an example to highlight the Subject and Subject Alternative Name attribute configurations necessary for handling random and changing MAC addresses in Cisco ISE release 3.1.

Configuration steps in Cisco ISE

In Cisco ISE:

  1. Upload the certificate generated in the MobileIron portal.

  2. Connect the MobileIron UEM servers.