What types of licenses are available in Cisco ISE?
Recently, Cisco changed the licensing model for Identity Services Engine (ISE). There are now three types of licenses, each offering different levels of functionality. Cisco ISE licenses are cumulative, meaning each higher tier includes all features of the lower ones.
The three license tiers are:
-
Essentials
-
Advantage
-
Premier
Below is a quick overview of what each license includes, based strictly on the official Cisco ISE Licensing Guide.
🔹 Essentials
Core features for secure network access:
-
RADIUS authentication (802.1X, MAB, web auth, EasyConnect)
-
TACACS+ for device administration
-
MACsec encryption support
-
SSO and SAML integrations
-
Guest access with sponsor/self-registration portals
-
REST APIs (monitoring and CRUD operations)
-
Passive identity services (ISE-PIC)
-
Wired and wireless network access control
🔹 Advantage
Includes Essentials, plus enhanced visibility and segmentation features:
-
BYOD onboarding with built-in Certificate Authority
-
Security Group Tagging (SGT) and TrustSec policy enforcement
-
Cisco ACI integration
-
Endpoint profiling and contextual visibility
-
Feed services for device intelligence
-
pxGrid (context sharing – on-prem and cloud)
-
Rapid Threat Containment (Adaptive Network Control)
-
AI Endpoint Analytics (visibility and classification)
-
User-Defined Network (UDN) support
🔹 Premier
Includes Advantage, with full compliance and threat response capabilities:
-
Posture compliance visibility and enforcement
-
Integration with Mobile Device Management (MDM/EMM) platforms
-
Full Threat-Centric NAC for dynamic policy control based on endpoint and threat context
! Licensing Notes
-
All tiers are subscription-based (1, 3, or 5 years)
-
Managed via Cisco Smart Software Manager (CSSM)
-
Licensing is per connected endpoint/session
-
Tiers align with increasing levels of access control, visibility, and automation