The Device Admin service must be explicitly enabled on the Cisco ISE node to activate TACACS+ functionality. Even with a Device Administration license installed, TACACS+ operations will not run until this service is turned on under the node's service settings.