In short: Cisco ISE licensing uses Essentials, Advantage and Premier subscription tiers, each including the tier below, counted on the peak number of concurrently active endpoints. Virtual and cloud nodes each need a VM licence, and TACACS+ needs a Device Administration licence per Policy Service Node. Subscriptions run for one, three or five years, with three as Cisco's default.
The three ISE subscription tiers
Cisco sells ISE endpoint licences as nested tiers. Premier includes everything in Advantage, and Advantage includes everything in Essentials, so you buy one tier for the endpoints that need it rather than stacking licences. The feature split below is taken from Cisco's current ISE licensing guide.
| Capability | Essentials | Advantage | Premier |
|---|---|---|---|
| AAA, RADIUS and 802.1X authentication | Yes | Yes | Yes |
| Guest access (hotspot, self-registration, sponsored) | Yes | Yes | Yes |
| Easy Connect (passive identity) | Yes | Yes | Yes |
| Profiling | No | Yes | Yes |
| BYOD onboarding | No | Yes | Yes |
| Context sharing with pxGrid, pxGrid Cloud and pxGrid Direct | No | Yes | Yes |
| User Defined Network | No | Yes | Yes |
| TrustSec (group-based policy) | No | Yes | Yes |
| Endpoint Analytics visibility and enforcement | No | Yes | Yes |
| Rapid Threat Containment (Adaptive Network Control) | No | Yes | Yes |
| Posture | No | No | Yes |
| MDM compliance checks | No | No | Yes |
| Threat-Centric NAC (TC-NAC) | No | No | Yes |
In practice, Essentials suits straightforward 802.1X and guest Wi-Fi. Advantage is the usual choice once you want to identify devices automatically, segment with security group tags or let other tools quarantine endpoints. Premier is for organisations that need to check device health or MDM compliance before granting access.
How endpoints are counted
ISE subscriptions are counted on active endpoints, normally measured by RADIUS sessions. Each feature has its own trigger, so a session that uses profiling and posture consumes Premier, while a simple guest session consumes Essentials. Cisco asks you to size on the peak number of endpoints you expect to be connected at the same time on a given day, not on the total number of devices you own.
Two things catch people out:
- Private and rotating MAC addresses on phones and laptops can raise consumption, because each new MAC address creates a new session. Cisco calls this out in its licensing guide, and a BYOD or guest network is where you will notice it.
- Compliance is enforced. If usage stays above 100% of what you have bought, or licences expire, for 30 days within a 60-day window, administrators lose administrative control and drop to read-only access until the position is fixed. Authentication and existing configuration carry on working, so users are not cut off, but you cannot change policy.
VM, device administration and evaluation licences
| Licence | What it covers | How it is sold |
|---|---|---|
| ISE subscription tier | Endpoint features (Essentials, Advantage, Premier) | Term subscription, one, three or five years; Cisco's default term is three years, with automatic 12-month renewal unless cancelled at least 60 days before the next term |
| VM licence | Each virtual machine or cloud-hosted ISE node | Perpetual, one per node; older Small, Medium and Large VM licences convert one-for-one to the common VM licence |
| Device Administration | TACACS+ for network device logins and command authorisation | Perpetual, one per Policy Service Node running TACACS+ |
| Evaluation | All features for up to 100 endpoints | Granted automatically for 90 days on a new installation |
Physical ISE appliances do not need a VM licence. Cisco's minimum order for an a la carte subscription is 50 endpoints, and subscriptions can be co-termed so that renewals line up. Licences are held in your Cisco Smart Account and consumed through Smart Licensing; see our Cisco security licensing guide for how Smart Accounts work across the portfolio.
Other ways to get ISE entitlement
- A la carte subscriptions, the usual route for a standalone ISE deployment
- Cisco Enterprise Agreements, for larger estates standardising on Cisco security
- Catalyst Advantage subscriptions: Cisco's guide says these include ISE Advantage licences, with the quantity depending on the switch, so check what you already own before buying
- Cisco User Protection Suite, whose Advantage tier includes ISE Premier alongside Secure Access, Duo Advantage, Secure Email Threat Defense and Secure Endpoint
Remember that posture needs licensing on both sides: Cisco's Secure Client ordering guide says ISE posture requires a Secure Client Premier licence for each user as well as ISE Premier.
How to size ISE licences
- Count concurrent endpoints per site at your busiest time, including phones, printers, IoT and guest devices. If you already run ISE, the licensing dashboard and session reports give you the real figure.
- Map features to groups. Decide which endpoints need only authentication and guest (Essentials), which need profiling or segmentation (Advantage) and which need posture or MDM checks (Premier).
- Allow for MAC randomisation on guest and BYOD networks, and for growth over the term.
- Plan the nodes: count virtual and cloud nodes for VM licences, and the PSNs that will run TACACS+.
- Check existing entitlement from Catalyst subscriptions, Enterprise Agreements or suites.
- Choose the term and co-term with any existing ISE subscriptions.
We do this sizing as part of every ISE quote. Pricing depends on tier, quantity and term, so ask us for a quote and contact us with your endpoint counts or a recent licensing report.
How Forever Systems supplies and supports Cisco Secure
We supply and support the whole Cisco security portfolio for UK organisations, alongside Cisco Meraki networking and Cisco voice.
- Architecture and sizing: the right mix of firewall, secure access, identity, endpoint, email, detection and response and OT security for your estate, whether as individual products or a Cisco security suite
- Licensing: Smart Accounts, subscription tiers, Enterprise Agreements and renewals, explained in plain English
- Deployment and migration, including ASA to Secure Firewall Threat Defense, AnyConnect to Secure Client, and Umbrella to Secure Access
- Integration across Cisco XDR, Splunk, Duo, ISE and Secure Access so products share telemetry and response actions
- Ongoing support: upgrades, policy reviews, end-of-life planning, licence management and renewals
Forever Systems Ltd is an independent IT and cyber security provider. We will always recommend what fits, Cisco or otherwise.
Want help choosing, licensing or migrating Cisco security products?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is the difference between ISE Advantage and Premier?
Advantage adds profiling, BYOD, pxGrid context sharing, TrustSec group-based policy, Endpoint Analytics and Rapid Threat Containment to the Essentials features. Premier includes all of that and adds posture assessment, MDM compliance checks and Threat-Centric NAC.
Is Cisco ISE licensed per user or per device?
Per endpoint. ISE counts concurrently active endpoints, usually by RADIUS session, so a user with a laptop and a phone connected at the same time uses two endpoint licences.
Are ISE licences perpetual?
The endpoint tiers are term subscriptions of one, three or five years. VM node licences and TACACS+ Device Administration licences are perpetual.
Do I need a separate licence for TACACS+?
Yes. TACACS+ device administration needs a Device Administration licence for each Policy Service Node that runs the TACACS+ service, in addition to your endpoint subscription.
What happens if I exceed my ISE licence count?
If you stay over your purchased count, or let licences expire, for 30 days within a 60-day period, ISE restricts administrative access until you buy enough licences. Network authentication continues to work.
Is there a free trial of Cisco ISE?
Every new ISE installation includes a 90-day evaluation licence with all features enabled for up to 100 endpoints, which is enough for a proof of concept.