In short: Cisco Umbrella SAML has two jobs: it authenticates web users at the SIG secure web gateway, and separately gives administrators dashboard single sign-on. It sits alongside Umbrella's other identities (networks, roaming computers, tunnels, network devices, and users and groups from Active Directory through the AD Connector, or from Microsoft Entra ID by provisioning).
The Umbrella identity types
Each deployment method creates its own kind of identity, and one request can match several. Umbrella applies the first policy in the list that matches any of them, so order matters.
| Identity | Created by | Typical use |
|---|---|---|
| Network | Registering a public IP address | Default policy for a site |
| Internal network or IP | Virtual appliance | Different policy for a subnet such as guest Wi-Fi |
| Roaming computer | Umbrella Roaming Security Module in Cisco Secure Client | Laptops on any network |
| Chromebook user | Cisco Security for Chromebook | Pupil and staff policy on ChromeOS |
| Network tunnel | IPsec tunnel (SIG) | All traffic from a SIG-connected site |
| Network device | Device integrations such as Cisco Meraki access points | Per-SSID or per-device DNS policy |
| User and group | Provisioned by the AD Connector, Microsoft Entra ID, Okta or a manual CSV import; matched to traffic by VAs, the roaming module or SAML | Role-based policy and named reporting |
User and group identities are the ones that make the biggest difference to schools and businesses alike. Cisco's package comparison lists Active Directory integration in every Umbrella package. SAML user authentication works through the secure web gateway, so it needs a SIG package; check your entitlement on the Cisco Umbrella packages page.
When a policy contains AD-linked identities, Umbrella checks them in a fixed order: AD user first, then AD computer, internal network, site, roaming client and finally network. Within the policy list itself, Umbrella works from the top down and applies the first policy that matches.
On-premises Active Directory: the AD Connector and VAs
For on-premises AD, Umbrella uses two components working together:
- The AD Connector, a Windows service that passes domain controller logon events to the VAs so they know which user is on which computer and IP address. It uploads users, groups and computers to the Umbrella cloud over HTTPS, sending only changes after the first sync. Passwords are not uploaded, Cisco says user information is hashed locally, and the connector does not read password hashes.
- Umbrella virtual appliances, which receive the connector's logon data and attach the user to each DNS request they forward.
Practical points from Cisco's documentation and our experience:
- The connector runs on a domain member server with a supported Windows Server release and .NET Framework, or directly on a domain controller that meets the same requirements.
- It needs a dedicated AD account with read and Replicating Directory Changes permissions (not Replicating Directory Changes All). Membership of the built-in Enterprise Read-only Domain Controllers group grants these.
- One connector per AD domain is enough to provision identities, with an optional second for redundancy. For VA integration, a domain controller needs a connector in the same Umbrella site.
- The connector sends events to VAs one way and unencrypted, so keep that path on a trusted internal network. Cisco recommends API key credentials to authenticate connectors and VAs to Umbrella.
- Build Umbrella policy around AD groups, and keep the list of groups that matter short.
- Laptops with the roaming module gather the logged-in user and groups from the operating system, so they are identified off network too.
Cloud directories: Microsoft Entra ID provisioning
If your users live in Microsoft Entra ID (formerly Azure AD), you can provision them into Umbrella from the cloud instead of, or alongside, the AD Connector. The integration uses the Microsoft Entra provisioning service:
- In the Umbrella dashboard, go to Deployments, Core Identities, Users and Groups, expand the Microsoft Entra card and generate a token on the API Keys page. Copy the URL and token straight away: the token is shown once.
- In the Microsoft Entra admin center, add Cisco User Management for Secure Access from the application gallery and enter the URL and token as the tenant URL and secret token on its Provisioning tab.
- Scope provisioning to the users and groups you need, test with a few using on-demand provisioning, then start provisioning and watch the provisioning logs.
Microsoft documents a limit of 200 provisioned groups, so plan which groups Umbrella really needs. If devices run older Secure Client or AnyConnect versions, Microsoft's guide describes syncing the AD objectGUID attribute through Microsoft Entra Connect so users are matched correctly, and says to turn off the on-premises AD Connector before importing it. Any Umbrella policy built on groups needs reconfiguring after groups are imported from Entra ID. Umbrella can also provision users and groups from Okta.
SAML: authenticating web users and dashboard admins
SAML appears in Umbrella in two separate places, which is a common source of confusion.
| Use | What it does | Who signs in |
|---|---|---|
| SAML user authentication for web traffic (SIG) | When traffic arrives from a network or tunnel identity without a user attached, the secure web gateway asks the user to authenticate with your identity provider, so web policy and reports can be per user | End users |
| Dashboard single sign-on | Administrators sign in to the Umbrella dashboard with your identity provider instead of an Umbrella password (Admin, Authentication, SAML) | Umbrella administrators |
SAML for web users has a few requirements that catch people out:
- Cisco lists Active Directory (through AD FS), Azure AD (now Microsoft Entra ID), Duo Security, Okta, OpenAM and PingID as supported identity providers, with a generic option for others.
- The web policy ruleset must have both SAML and HTTPS inspection turned on, because Umbrella reads a cookie inside HTTPS traffic as the authentication surrogate, and the Umbrella root certificate must be on every client behind that network or tunnel.
- SAML identities are matched to users and groups already provisioned into Umbrella, for example by the AD Connector or a CSV import.
- SAML is not supported for the roaming module, which identifies users from the operating system instead.
- IP surrogates can help where a cookie cannot be set; Cisco recommends cookie surrogates where several users share an IP address, as in Citrix or VDI.
- If you use AD FS, exclude its URL from HTTPS inspection so authentication is not broken.
Dashboard SSO only handles sign-in; each administrator's role is still set in Umbrella, and the email address must match in both places. Microsoft publishes a gallery application, Cisco Umbrella Admin SSO, for Entra ID that supports both service-provider and identity-provider initiated sign-in, and admin accounts still need creating in Umbrella. If you want stronger sign-in for your identity provider itself, Cisco Duo Single Sign-On can sit in front of it.
Multi-org and MSP consoles: SAML user authentication for web traffic is set up in each child organisation. Administrators can still use SAML single sign-on for the multi-org or MSP console itself, except on consoles that use a Cisco CEC login. See Umbrella multi-org and MSP consoles.
Designing identity-based policy
- Start with a default network policy that protects everyone, then add group policies above it for exceptions.
- Keep the number of groups small and meaningful: staff, pupils, IT, finance, guests.
- Use the same groups for content filtering and reporting so safeguarding or HR reviews make sense.
- Document which identity source is authoritative for each group, especially in hybrid AD and Entra ID estates.
- Test with real users in a pilot group before changing the default policy.
Identities in Secure Access, and how we help
Cisco Secure Access uses the same kinds of identity sources, and Cisco's Entra ID provisioning application is now named for Secure Access. A tidy identity design in Umbrella transfers more cleanly when you migrate; Umbrella's end of sale is 31 January 2027. See Umbrella to Secure Access migration.
We install and harden AD Connectors, set up Entra ID provisioning, configure SAML for SIG users and dashboard SSO, and build group-based policy. Contact us to plan your identity integration, or return to the Cisco Umbrella deployment guide.
How Forever Systems supplies and supports Cisco Umbrella
We supply, deploy and support Cisco Umbrella for UK organisations, and plan the move to its successor, Cisco Secure Access.
- Package selection: DNS Security or SIG, Essentials or Advantage, plus add-ons, matched to your users, sites and compliance needs
- Deployment: network DNS forwarding, virtual appliances, the roaming module in Cisco Secure Client, Chromebooks, IPsec tunnels from Cisco Meraki and other firewalls, and Active Directory, Entra ID or SAML identity integration
- Policy design: security categories, content filtering for schools and businesses, allow and block lists, and reporting
- Migration planning from Umbrella to Cisco Secure Access ahead of Cisco's end-of-sale and end-of-support dates
- Ongoing support: reporting, policy tuning, renewals and licence changes
Forever Systems Ltd is an independent IT and cyber security provider and also supplies the wider Cisco Secure portfolio.
Want a Cisco Umbrella quote, deployment or migration plan?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Does Cisco Umbrella support SAML?
Yes, in two ways: SAML user authentication lets the SIG web gateway identify users whose traffic arrives from a network or tunnel without a user attached, and SAML single sign-on lets administrators sign in to the Umbrella dashboard through your identity provider.
Can Cisco Umbrella use Microsoft Entra ID groups?
Yes. Users and groups can be provisioned from Microsoft Entra ID into Umbrella using the Cisco User Management for Secure Access gallery application and a token from the Umbrella dashboard. Microsoft documents a limit of 200 provisioned groups.
Does the Umbrella AD Connector upload passwords?
No. Cisco says no passwords are uploaded and user information is hashed locally. The connector account needs Replicating Directory Changes permission but not Replicating Directory Changes All, so it cannot read password hashes.
How many AD Connectors do I need?
One per AD domain is enough to provision identities, with an optional second for redundancy. For virtual appliance integration, each domain controller needs a connector in the same Umbrella site.
Why does SAML in Umbrella need HTTPS inspection?
Umbrella uses a cookie inside HTTPS traffic as the user's authentication token, so the web policy must have HTTPS inspection turned on and the Umbrella root certificate must be installed on client devices.
Can I set up SAML on the Umbrella multi-org console?
SAML user authentication for web traffic is set up in each child organisation. Administrators can use SAML single sign-on for the multi-org or MSP console itself, except on consoles that use a Cisco CEC login.