When configuring IKEv2 AnyConnect using AnyConnect-EAP, the administrator can define group aliases on the headend and have the user pick the appropriate alias when they connect. This allows the administrator to separate profiles for administrators and employees so that authorization differs when they connect.
