Authorization failed or unapplied for client

If you have Authorization failed or unapplied for client or Authorization failed for client (depending of the model and SW on the switch), together with Authentication result overridden for client, and immediately after that Authorization succeeded for client , although it says that it succeeded, and in ISE Operations Monitoring for Authentications everything is green, you could still have an issue. On some switches you will have:

*Mar  1 00:48:03.340: %AUTHMGR-5-FAIL: Authorization failed or unapplied for client (0014.e223.ad54) 
on Interface Fa0/12 AuditSessionID 0DF3D9B40111000D00F12AD4
*Mar  1 00:48:03.349: %DOT1X-5-RESULT_OVERRIDE: Authentication result overridden for client (0014.e223.ad54) 
on Interface Fa0/12 AuditSessionID 0DF3D9B40111000D00F12AD4
*Mar  1 00:48:04.582: %AUTHMGR-5-SUCCESS: Authorization succeeded for client (0014.e223.ad54) 
on Interface Fa0/12 AuditSessionID 0DF3D9B40111000D00F12AD4

On others:

Jan 01 18:17:06.928: %AUTHMGR-5-FAIL: Authorization failed for client (0014.e223.ad54) 
on Interface Fa0/12 AuditSessionID 0DF3D9B40111000D00F12AD4
Jan 01 18:17:06.936: %DOT1X-5-RESULT_OVERRIDE: Authentication result overridden for client (0014.e223.ad54) 
on Interface Fa0/12 AuditSessionID 0DF3D9B40111000D00F12AD4
Jan 01 18:17:07.716: %AUTHMGR-5-SUCCESS: Authorization succeeded for client (0014.e223.ad54) 
on Interface Fa0/12 AuditSessionID 0DF3D9B40111000D00F12AD4

Switch#show authentication sessions interface f0/12
            Interface:  FastEthernet0/12
          MAC Address:  0014.e223.ad54
           IP Address:  10.10.10.10
            User-Name:  DOMAIN\user01
               Status:  Authz Failed
               Domain:  DATA
      Security Policy:  Should Secure
      Security Status:  Unsecure
       Oper host mode:  multi-auth
     Oper control dir:  both
        Authorized By:  Authentication Server
          Vlan Policy:  N/A
      Session timeout:  N/A
         Idle timeout:  N/A
    Common Session ID:  0DF3D9B40111000D00F12AD4
      Acct Session ID:  0x0000002D
               Handle:  0x8C000035

Runnable methods list:
       Method   State
       dot1x    Authc Success

So you actually have Authc Success, but Status: Authz Failed And also ACL is not applied, and show ip access-lists interface returns nothing:

Switch#show ip access-lists interface F0/12
Switch#

Probable reason is issue with DACL (downloadable access list), web authentication or some other part of authorization profile. You should first check DACL, especially if it is in any way more complicated. Here are examples of DACLs that are fine and how they will be transformed when pushed to the switch:
DACL entry on ISE:

permit tcp any any

on switch will be translated to:

permit tcp host 10.10.10.10 any (15 matches)

DACL entry on ISE:

permit tcp any any eq 22 established

on switch will be translated to:

permit tcp host 10.10.10.10 any eq 22 established

DACL entry on ISE:

permit tcp any eq 22 any established

on switch will be translated to:

permit tcp host 10.10.10.10 eq 22 any established

802.1X Remote desktop (RDP) user authentication

When connecting through remote desktop (RDP) to machines that are connected to 802.1X enabled switch ports (for example in Cisco ISE installations), connectivity issues, and session failures and disconnection issues could happen. Most of these issues are related to the fact that native 802.1X supplicants don't authenticate and authorize users that connect through RDP. Access lists on port are left as you have machine with no user logged on it. In most cases these ACLs allow only traffic for logging user on domain etc., and remote desktop traffic is not allowed by these ACLs. We have resolved this issue by using Cisco AnyConnect Secure Mobility Client with Network Access Manager - NAM module, as it behaves better and eliminates this problem by authenticating and authorizing user that is connecting through RDP and granting all rights and expected ACLs.

Cisco ISE - duplicate IP address on Windows 7

Windows 7 sometimes reports IP address conflict (duplicate IP address warning message) when connected to 802.1X enabled ports while device tracking feature is used on switch. Device tracking is used in most Cisco ISE designs. You can check if you have device tracking on switch with:

switch#sh run | inc trackin
ip device tracking
switch#

This usually happens on Windows Vista, Windows 2008 and Windows 7 clients, when disconnecting and connecting again (or shut no shut on switch), after locking and unlocking, or logging off and then logging on. Reason behind this is that windows machines could send ARP packets at the same time the switch is probing for device status. Possible solutions are:
Solution 1 - Delay ip device tracking ARP probe for few seconds (you should have IOS version that supports this command).

Switch(config)# ip device tracking [probe {delay interval}]

ARP packet will be sent few seconds after link-up, and it will not happen at same time when windows 7 clients send first ARP packets. For example:

switch(config)#ip device tracking probe delay 5

Solution 2 - Disable gratuitous ARP in Windows registry [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters] Set ArpRetryCount (32-bit DWORD) to 0 If you decide to use second method, please be sure to manage duplicate address problem with some other controls on switches or elsewhere.

With device tracking probe delay we had really good results, and believe there is no need for registry tuning (and problem with it is that when new machine with default registry settings is connected, you will again get same duplicate IP address problem).