How do I assign his privilege level using Microsoft IAS Radius server

Once its done on the server, I assume that i dont have to define his privilege level on the devices !

You need to add a vendor-specific attribute to the user profile: "shell:priv-lvl=1"

(substitute 1 to whatever level you want to grant the user)

But I have no clue how to do that, check the IAS docs.

If you are ok with the non-privileged mode (level 1) access you do not have to define anything on the devices, but if you want to grant access to commands above privilege level 1 you have to define a new privilege level and add some commands to it.

IOS only have level 1 and 15 pre configured.

The string you specified was the correct one.

On Windows IAS Server, I did it as follows:

1. Created a new Remote Access Polic

2. To it I added the relevant group

3. Selected: Grant remote access permission

4. Go to: Edit profile

5. Advanced Tab, add: Cisco-AV-Pair, with the value:

shell:priv-lvl=10

or whatever value is required

Then on the Cisco devices:

#aaa authorization exec default group if-authenticated local

#username privilege 10

#privilege exec level 10 show startup-config

This of course assumes you have the other AAA configuration in place.

It worked for me.