Comprehensive and Detailed Explanation From HPE Aruba Networking ClearPass portfolio:
Network Device Groups (NDGs) allow administrators to categorize switches and controllers by location or function. In a multi-site deployment, ClearPass can use a "Service Rule" that looks at which NDG the request came from. For example, if a request comes from the "London-Switches" group, ClearPass is configured to use the London AD domain; if it comes from "Tokyo-APs," it uses the Tokyo AD source. This prevents
"cross-talk" between global regions and improves authentication speed.

ClearPass and EMM/MDM integration provides "Closed-Loop" security. When ClearPass identifies a
"Stolen" device status (either via its own database or a real-time check), it can use a Context Server Action to signal the EMM server. The EMM server, which has deep administrative control over the device OS, can then execute high-level security commands such as Remote Wipe (deleting all data) or displaying a "Lock Screen" message to the person holding the device.

To send guest receipts via both email and SMS, the administrator must configure the email relay and SMS gateway in the Messaging Setup menu. This enables ClearPass Guest to deliver registration notifications through multiple communication channels simultaneously.

After the initial authentication and context-gathering stages, ClearPass enters the Roles and Enforcement phase. During Role Mapping, ClearPass assigns one or more internal roles based on the gathered data. The Enforcement Policy then evaluates these roles against defined rules to make the final "Allow" or "Deny" decision. This stage is responsible for selecting the Enforcement Profile, which contains the final RADIUS attributes (like VLANs or ACLs) sent back to the Network Access Device.