In short: Cisco Umbrella on Chromebooks now uses Cisco Security for Chromebook, a Chrome extension built on Manifest V3 that replaced the legacy Umbrella Chromebook clients. It sends the whole device's DNS to Umbrella over DNS over HTTPS, and for SIG customers adds secure web gateway protection in the Chrome browser.
What changed: from the legacy clients to Cisco Security for Chromebook
Umbrella used to offer two Chromebook clients: the Umbrella Chromebook Client for DNS-layer protection and the SWG Umbrella Chromebook Client for SIG customers. Both have been replaced by a single extension, Cisco Security for Chromebook, which Cisco announced as generally available in a support notice dated 1 October 2025.
The change was driven by Google's move from Manifest V2 to Manifest V3, the new framework for Chrome extensions; Cisco says it developed the new client with Google to support that migration. The migration path depended on which client you had:
| Legacy client | What happened |
|---|---|
| SWG Umbrella Chromebook Client (SIG customers) | Upgraded automatically to Cisco Security for Chromebook |
| Umbrella Chromebook Client (DNS client) | Customers had to migrate manually to the new extension |
If your Chromebooks still run the legacy DNS client, plan the migration now. Cisco's notice says Cisco Security for Chromebook is the only client you need going forward.
What Cisco Security for Chromebook protects
- DNS-layer security for the whole device. The extension routes ChromeOS DNS traffic to Umbrella's DNS over HTTPS (DoH) resolvers, so protection covers all apps and components, not only the browser.
- Web protection in Chrome for SIG customers. It sends browser traffic through the Umbrella secure web gateway for full URL filtering and inspection. SIG customers can turn the web proxy off and use DNS protection only.
- Features the old DNS client lacked. Cisco lists custom block pages, SafeSearch and the intelligent proxy as additions.
- One client for DNS and web. There is no longer a separate SWG client to manage.
- Per-user identity. Requests are tied to the signed-in Google user, so you can apply different policies to pupils and staff and see who did what in Umbrella reporting.
The extension works with both Umbrella DNS and SIG packages. Cisco says each Chromebook must be able to upgrade to ChromeOS 110 or later, and advises checking each device's Auto Update Expiration status with Google; older devices that cannot update will not get the new client.
Deploying through the Google Admin console
Managed Chromebooks get extensions through the Google Admin console. The general approach:
- In the Umbrella dashboard, prepare your Chromebook policy and identities, and collect the configuration details Cisco's user guide asks for.
- In the Google Admin console, choose the organisational unit (for example pupils, staff or a single school in a trust).
- Force-install the Cisco Security for Chromebook extension for that unit and apply the configuration policy from Umbrella.
- Install the Umbrella root certificate on Chromebooks if you use the web proxy or HTTPS block pages, so they display without certificate errors.
- Block or restrict other DNS-changing and proxy extensions, and stop users removing the extension.
- Pilot with one class or year group, check activity appears in Umbrella, then expand.
Cisco's Chromebook client documentation has the exact settings, including templates for managed guest sessions, bypassing internal domains from DNS over HTTPS so internal names still resolve, and an option to report each Chromebook's private IP address. For legacy DNS-client customers, migrating means deploying the new extension and then removing the old app once the new one is reporting.
Chromebooks in UK schools
Chromebooks are often the largest single device group in a school or multi-academy trust, and many go home every night. A DNS-only setup on the school network does nothing once a device leaves the building, which is why a client on the device matters.
Schools also need differentiated policy (pupils, staff, sixth form), reporting that safeguarding leads can use, and filtering that is hard to bypass. Cisco Security for Chromebook helps with each of these, but schools must still satisfy themselves that their overall filtering and monitoring meet Department for Education expectations; Umbrella is a filtering tool, not a monitoring product. Our Cisco Umbrella for schools page and the appropriate filtering for schools guide cover this in detail.
Some schools will remember DfE guidance about removing Umbrella from Chromebooks the department supplied (those ordered before October 2021), whose Umbrella licences were extended to 30 September 2022. That guidance concerned those specific devices, not Umbrella in general, and it reminded schools that removing Umbrella left them responsible for providing alternative safety software.
Planning ahead and how we help
Umbrella's end of sale is 31 January 2027, with support until 31 January 2029. Cisco names Secure Access DNS EDU Essentials as the migration product for Umbrella's Education versions. If you are deploying or migrating Chromebook protection now, it is worth planning for that move at the same time; see Cisco Umbrella end of life.
We configure Cisco Security for Chromebook in the Google Admin console, migrate schools off the legacy DNS client, set up pupil and staff policies and train safeguarding staff on reports. Contact us to get started, or read the full Cisco Umbrella deployment guide.
How Forever Systems supplies and supports Cisco Umbrella
We supply, deploy and support Cisco Umbrella for UK organisations, and plan the move to its successor, Cisco Secure Access.
- Package selection: DNS Security or SIG, Essentials or Advantage, plus add-ons, matched to your users, sites and compliance needs
- Deployment: network DNS forwarding, virtual appliances, the roaming module in Cisco Secure Client, Chromebooks, IPsec tunnels from Cisco Meraki and other firewalls, and Active Directory, Entra ID or SAML identity integration
- Policy design: security categories, content filtering for schools and businesses, allow and block lists, and reporting
- Migration planning from Umbrella to Cisco Secure Access ahead of Cisco's end-of-sale and end-of-support dates
- Ongoing support: reporting, policy tuning, renewals and licence changes
Forever Systems Ltd is an independent IT and cyber security provider and also supplies the wider Cisco Secure portfolio.
Want a Cisco Umbrella quote, deployment or migration plan?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Does Cisco Umbrella work on Chromebooks?
Yes. Cisco Security for Chromebook, a Chrome extension, gives Umbrella DNS-layer protection to the whole ChromeOS device and, for SIG customers, secure web gateway protection in Chrome.
What happened to the Umbrella Chromebook Client?
It has been replaced by Cisco Security for Chromebook, built on Manifest V3. Customers on the legacy SWG Chromebook client were upgraded automatically; customers on the legacy DNS client had to migrate manually.
Which Chromebooks can run Cisco Security for Chromebook?
Cisco says the device must be able to upgrade to ChromeOS 110 or later. Check each model's Auto Update Expiration status with Google, because devices that no longer receive updates cannot run the new client.
How do I install Cisco Security for Chromebook?
Force-install the extension for the right organisational units in the Google Admin console and apply the configuration from your Umbrella dashboard, following Cisco's user guide for DNS or SIG customers.
Does Cisco Security for Chromebook protect devices at home?
Yes. Because it runs on the device, the same Umbrella policy applies on any network, which is why schools use it for Chromebooks that go home.
Is Cisco Umbrella on Chromebooks enough for KCSIE?
No single product makes a school compliant. Schools must satisfy themselves that their filtering and monitoring meet DfE expectations; Umbrella provides filtering, and monitoring needs a separate approach. We can help you assess this.