Cisco Access Manager: cloud NAC in the Meraki dashboard

What Cisco Access Manager is

Network access control (NAC) decides who and what may join the network, and what they can reach once they are on. Traditionally that means a RADIUS server or a dedicated NAC platform on premises, plus the skills to run it.

Cisco Access Manager moves that job into the Meraki dashboard. Cisco describes it as an access control product that manages network access for users and endpoints without an external RADIUS integration, delivered as pure software as a service: the policy engine and configuration are hosted in the cloud, with no server hardware or software to install. You write access rules in the dashboard, and Meraki switches and access points enforce them.

Cisco announced general availability on 10 November 2025 and has added features steadily since, including cloud-based device profiling (generally available from 1 July 2026) and per-device identity PSK (September 2026). Cisco says it is available globally except in the Canada, China and India regional clouds and the Meraki FedRAMP cloud, so it can be used by organisations on Meraki's European hosting.

How it authenticates users and devices

• Certificates (802.1X with EAP-TLS): managed laptops and phones authenticate with a certificate from a certificate authority you upload, with an optional lookup against Microsoft Entra ID to check the account and its groups.
• Username and password with Microsoft Entra ID (EAP-TTLS): for organisations that prefer credential-based sign-in, checked against Entra ID users and groups.
• MAC address (MAB): for printers, cameras, phones and other IoT devices that cannot do 802.1X, matched by MAC address, client group or profiling labels.
• Identity PSK: on Wi-Fi, each rule or each individual device can be given its own pre-shared key, so one compromised device does not mean changing the key for all of them.
• Guest access: guest SSIDs can use Access Manager for visibility and filtering of guest devices; Cisco notes that guest sessions then consume licences.

Rules are evaluated top to bottom, and the default rule denies access, so nothing gets on by accident. Once matched, a rule can allow access, deny it, or allow restricted access by assigning a VLAN, a voice domain, a Meraki group policy, an identity PSK or an Adaptive Policy group (Cisco TrustSec security group tag).

Profiling and visibility

Access Manager profiles endpoints from what it sees on the network (CDP, DHCP and LLDP) and labels them by type, manufacturer, model and operating system. Those labels can be used in access rules, so all printers or all IP cameras can be treated the same way without listing every MAC address. Endpoints can also be provisioned in advance, individually, by CSV import or through the API, and grouped into client groups.

The session log shows who and what authenticated, when, where and how, including the certificate details used for each certificate-based sign-in. Cisco also lets you query Access Manager data through the Cisco AI Assistant in the dashboard (read-only).

Two design points from Cisco's documentation are worth building in from the start. Newly seen devices take a few minutes to be profiled, and Access Manager does not currently use RADIUS Change of Authorization to re-authenticate a device once it is profiled, so rules that rely on profile labels match from the device's next authentication; Cisco suggests a restricted default rule that lets new devices be profiled first. Cisco also recommends a unified endpoint management (UEM or MDM) tool, such as Meraki Systems Manager, to push certificates and 802.1X settings to laptops and phones; Access Manager does not currently check device compliance against those platforms. We plan rules around both.

What it works with

Two points matter when planning. First, Access Manager works with Meraki devices that are configured from the cloud, so switches and access points must be in the dashboard. Second, Access Manager assigns Adaptive Policy groups, but enforcing them depends on the network devices' own licence (MS or MR Advantage, or the equivalent Advanced edition) and hardware support. Our pages on Meraki MS switches, MS licensing and the MR Enterprise licence cover those tiers.

Cisco also lists fallback options for when the cloud cannot be reached: RADIUS caching and a guest VLAN on switches, and extended local authentication on wireless, which downloads the certificate chain to Meraki access points so that certificate-based access can carry on.

Cisco Access Manager licensing

Cisco sells Access Manager as a single tier, Cisco Access Manager Advantage, separate from the switch and access point licences. How it is counted and bought, according to Cisco's licensing and ordering guide:

• Metric: concurrent active endpoints. An endpoint is any unique MAC address that authenticates through Access Manager, so a laptop and a phone used by one person count as two.
• Compliance figure: each day Meraki takes the 90th percentile of the daily peak concurrent sessions over the last 10 days, so one unusual spike does not push you out of compliance. Cisco says compliance is currently tracked and enforced for co-term licences, with the usual 30-day grace period if exceeded or expired.
• Ways to buy: subscription (hardware-agnostic, with the term set when you order), co-term (terms of 1, 3, 5, 7 or 10 years, aligned to your organisation's single expiry date and prorated) or as part of a Cisco Enterprise Agreement.
• Not available with per-device licensing (PDL).
• Free trial: a 90-day, full-featured trial for co-term organisations, extendable twice by 30 days. Cisco says the trial is not available to subscription organisations.

To size it, Cisco suggests counting staff multiplied by their typical number of devices, plus every printer, camera, sensor and other headless device, plus room for growth. We can help with that count and quote on the purchasing model that matches your organisation. Ask us for a quote.

Access Manager or Cisco ISE?

Cisco also sells Cisco Identity Services Engine (ISE), its long-established NAC platform, which runs on your own appliances or virtual machines and works with Cisco and third-party network equipment. Access Manager is the simpler, cloud-only option for networks built on Meraki and cloud-managed Catalyst devices.

As a rough guide: if your network is Meraki-managed and you want certificate, Entra ID and IoT access control without running servers, Access Manager is the natural fit. If you need posture assessment, guest portals with complex workflows, mixed-vendor network devices or features Access Manager does not yet offer, ISE is the more complete platform. Our sister site covers Cisco ISE in detail, and we are happy to compare the two for your network.

How Forever Systems helps

Forever Systems is a Cisco Partner. We can check that your Meraki switches, access points and licences support what you want to enforce, design access rules for staff, guests and IoT devices, set up certificate-based or Entra ID authentication, run a proof of concept in monitored mode before enforcing (Cisco's free trial is for co-term organisations), and quote the licences. Contact us to talk about network access control on Meraki.