That's an interesting question, adecisco. Like you said, you can limit number of concurrent guest login and number of registered device per user but I haven't come across a way to limit number of AD user login. I would think it would have to be a by number of active RADIUS session for the user but I doubt that there is a condition attribute that does this check that you can use.

Yeah.. I am thinking the same but you would need to keep track of the number of active RADUS session for the user. ISE already have that information, it just need to make it available for us to use.