In a Pre-Authentication workflow (often used in Captive Portals), ClearPass first checks the user's credentials locally or against an external source before the actual NAD (switch/controller) sends the final RADIUS request. For this to work seamlessly, the same service or logic in ClearPass must be able to handle the initial check and the subsequent NAD request to ensure consistency in role assignment and session tracking.

ClearPass OnGuard licensing is based on the unique endpoint, not the number of connections or checks. A single device that connects via wired in the morning, Wi-Fi in the afternoon, and VPN in the evening- triggering a health check each time-will only consume one OnGuard license for that 24-hour period. This
"per-device" model makes licensing predictable for enterprise deployments with roaming users.

While caching can sometimes cause issues (as seen in Q76), enabling 'Use Cached Results' is often necessary for efficiency in complex multi-stage authentications. If this is not enabled , ClearPass may fail to properly correlate new status changes (like a profile update) with the existing session, leading the system to revert to a default or previous decision rather than dynamically adjusting the access based on the latest context.

Comprehensive and Detailed Explanation From HPE Aruba Networking ClearPass portfolio:
Health Checks are the core mechanism of OnGuard. These checks look for specific attributes on the endpoint, such as whether the antivirus is up-to-date, if the OS firewall is enabled, or if unauthorized applications (like peer-to-peer software) are running. The result of these checks is a "Posture Token" (Healthy, Unhealthy, or Unknown) that ClearPass uses to make enforcement decisions.