Considerations when Linking

Linking Pure Access Cloud with Engage

To add supported Schlage devices (RC11, RC15, RCK15, LE, LEB, NDE, NDEB) to a Pure Access Cloud tenant, link the tenant with Engage first. Linking changes how the tenant handles credentials, enrollment, and several rule types — review the sections below before linking.

Commissioning Hardware

• Schlage devices commission to an Engage site created when the PAC Tenant is linked with Engage.
• Legacy Isonas RC-04 and IP Bridges continue to commission directly to Pure Access Cloud through the ISONAS configuration tool.

!Once a tenant is linked with Engage, the Schlage RC line is the only supported enrollment reader.

Credential Changes After Linking

Schlage devices do not read data in the same manner that Isonas devices do*. Therefore, when a tenant is linked with Engage, credential enrollment is changed to comply with the requirements of Schlage devices (see below). As a result, existing credentials (except Isonas Pure Mobile and Key Pins) go into an “Unknown Format” that will still work with Isonas devices; but will need to be migrated or re-enrolled before they will work with compatible Schlage devices.

*When a legacy Isonas device (RC03, RC04, IP Bridge) enrolls a credential by presentation, the raw read data is captured and then filtered through the bitmask setting applied to that device and resolved to the badge ID added to the user profile in Pure Access Cloud. If the credential format is not supported or the bitmask is not set correctly for that format, although the credential may work, the enrolled badge ID will not match the hotstamp on the physical badge. This can be useful as it allows for the enrollment of multiple, and even unsupported credential formats (for example, the CSN of unsupported smart credentials such as HID iclass). However, if a credential was enrolled in this manner it may not be compatible with Schlage devices if the tenant is later linked with Engage

Credential Migration

Migration converts existing credential data into the format required by Schlage devices, and requires the credential’s format to be known and entered. See Migrating Credentials (Legacy to Engage) [link TBD] for the procedure.

• If migration fails, decline the credential at a Schlage Reader Controller to collect the necessary read data, then retry.
• If migration fails again, re-enroll the credential so it works with compatible Schlage devices.
• If a newly introduced credential format requires a bitmask change, push the updated bitmask to legacy Isonas hardware so it can continue reading it.

_h4. Whats required to for a credential to migrate successfully
hold for zendesk – 665717. critical distinction about how credentials migrate based on how they were enrolled, and wehre they
<INTERNAL LINK EXPLANATION

Credential Enrollment Methods

Method	Requirements
Presentation Enrollment	This can only be performed at a Schlage RC and it requires the correct credential format to be entered. If you add only Schlage Wi-Fi devices (NDE, LE) to a tenant with existing Isonas devices, presentation enrollment will not be available on that tenant until a Schlage RC is enrolled. .
Manual Enrollment	Requires the correct credential format, facility code, and badge ID. Facility code is not required for Isonas Proprietary Prox, Isonas DESFire, Isonas HID, Isonas Mobile, or Schlage Mobile credentials.

*See the video “Enrolling Physical Credentials in Pure Access Cloud After Linking a Tenant with Engage” for examples. It does not cover bitmasking issues that may affect existing legacy Isonas devices.

Supported Credential Formats

Although Schlage devices can support numerous 125kHz Prox formats and 13.56MHz smart credentials, when utilizing both Isonas and Schlage devices in the same Pure Access Cloud tenant, it is important to utilize a credential format that is supported by both devices and that the bitmask be set properly on Isonas devices.

Isonas devices can only support ONE Prox format credential via bitmasking and therefore once a prox format credential has been selected and the bitmask pushed out to the Isonas devices, you will want to stay with that format in order to avoid credential read issues going forward

*If you wish to utilize 13.56MHz smart credentials across an installation and Isonas devices are included in the integration, you will need to use Isonas DESFire credentials as they are the only smart credential that supports secure sector reading (encryption) by Isonas devices. * Isonas IP Bridges require the use of R1 readers and that their bitmask be set to ISONAS in order to support Isonas DESFire credentials. * Schlage Reader Controllers can be configured to read the Isonas DESFire format with the CE5901-0402 configuration card. Please note that Schlage Devices can only read one version of DESFire at a time. Therefore, if configured to read Isonas DESFire, they will not be able to read Schlage DESFire unless they are returned to their default configuration; default configuration of devices is a paid service requiring you to ship the devices in or arrange for a paid site visit.

Mobile Credentials

Credential	Compatible hardware
Isonas Pure Mobile	RC-04 Reader Controllers and IP Bridges equipped with Isonas R1 readers.
Schlage Mobile	Schlage Reader Controllers, Bluetooth-enabled NDEB/LEB Wi-Fi locks, and IP Bridges with MTB readers. Requires Schlage Compatibility Mode enabled on the corresponding IP Bridge access point in Pure Access Cloud device settings.

Both mobile ID apps can be installed on the same phone and tied to the same cardholder record. Select the app that matches the reader or controller model at each access point.

Functional Differences Between Schlage and ISONAS devices

Setting	Behavior with Schlage devices
Credential Time Limit	Resolves to the hour, not the minute. A 9:40–11:15 window approves the credential between 9:00 and 11:00.
Credential Count Limit	Approvals at Wi-Fi devices do not deduct from the count limit on check ins.
Global Re-lock Time	Does not currently apply to Schlage devices.

Look here for more details between the RC-04 and Schlage can be found here.

Auto-Unlock with Badge (“First Person In”)

Auto-Unlock w/Badge rules are configured differently with Schlage devices, using a feature called First Person In. Enable it under Auto-Unlock rules in the Schlage Reader Controller’s device settings. Any user with Grant Access permission at the access point during the auto-unlock window can start the unlock by presenting a valid credential.

!When First Person In is enabled, ALL Auto-Unlock rules at that access point require a valid credential presentation before the door unlocks.

Holiday Events

Schlage Reader Controllers do not support single events that run beyond 24hrs and therefore Holiday Events are not available in Engage linked tenants.
Events (Lock, Unlock and Lock Down) can be used to achieve similar outcomes. For periods extending beyond 24hrs, individual events must be created or each day.

The only event that will override a Grant Access weekly rule is a Lock Down event; wherein the only users that will have access are those with permission via an existing weekly rule AND who hold a credential with Master Bypass special property. An alternate option is to temporarily deactivate the weekly rule and then reactivate it at the end of the desired period

*Best practice — run a Holiday report before linking to capture existing holiday schedules so they can be recreated as events afterward.

Active Directory

Once a tenant is linked with Engage, Active Directory can no longer sync credential data — only users and user groups. Active Directory integration requires an RMR or 51+ door license.

Hardware Differences: RC-04 vs. Schlage RC

The RC-04 uses an 8-wire pigtail; the Schlage RC uses a 12-wire pigtail. Look here for more details on the diffrences

Using the Engage Mobile App

The Engage mobile app is ONLY use for:

• Commissioning Schlage RC devices and offline devices (NDE, LE, etc.)
• Schlage device network configuration
• Updating Schlage offline devices from the server outside their scheduled check-in window
  

!The Engage web portal should never be used for any reason when managing a Pure Access cloud site.

ALL administration is performed in Pure Access cloud (manage all users, device settings, edit rules in Pure Access Cloud).

This manual is regularly updated to ensure accuracy. If you have any questions, concerns, or notice any inaccuracies, please contact our support team.