Migrating from Cisco Umbrella to Cisco Secure Access

In short: Umbrella to Secure Access migration moves your Umbrella DNS or SIG organisation onto Cisco Secure Access DNS Defense or Secure Internet Access. You need an active, paid Secure Access subscription and its claim code, then Cisco's Upgrade Manager copies policies across as Secure Access rules. Audit identities, tunnels, devices and add-ons first, then pilot before cut-over.

Package mapping

Cisco maps each Umbrella package to a Secure Access equivalent. Umbrella DNS becomes Secure Access DNS Defense, and Umbrella SIG becomes Cisco Secure Access with Secure Internet Access (SIA).

Secure Access is ordered by use case: Secure Internet Access and Secure Private Access (SPA), each in Essentials and Advantage tiers, plus the separate DNS Defense packages for organisations that only need DNS-layer protection. See Secure Access licensing on our Cisco Secure site. The L7 Cloud Firewall add-on, Reserved IP (Regional) and Umbrella for DNA have no migration product; see Cisco Umbrella end of life for the full list.

Moving down a tier changes what you get. Cisco's upgrade guide warns that if you go from an Advantage package to an Essentials one as part of the move, features not in the new package stop being visible or working, so review and remove them first.

Cisco's offer and tooling

Cisco advertises a special upgrade offer for Umbrella customers who move to Secure Access, and describes the move as cost-effective, but it does not publish the terms on its website. Ask us for the current position before you plan around it.

For the technical move, Cisco provides an automated Upgrade Manager inside the Umbrella dashboard. Cisco says Umbrella customers can typically migrate in an hour or less with it, while its upgrade guide adds that the time depends on how much data and how many policies are copied. That is Cisco's figure for the policy move itself; the planning, testing and device work around it take longer, and we plan for that.

A few points from Cisco's upgrade guide shape how we run it:

• Umbrella keeps protecting you during the upgrade, though Cisco recommends running it outside business hours.
• Umbrella policies are copied into Secure Access as internet access rules in a single access policy. Changes made in Umbrella afterwards do not sync, so make further changes in Secure Access.
• Secure Access applies the first matching rule, so the copied rules need reviewing and, if necessary, reordering.
• Some Layer 7 applications in the Umbrella firewall policy are not in Secure Access, and the same category can contain different applications, so category-based firewall rules need checking.

Eligibility and prerequisites

Cisco's SIG upgrade guide sets some conditions before the automated route is available:

• You need an active, paid Secure Access subscription. Secure Access trial licences are not supported for the upgrade.
• You need Full Admin access to the Umbrella organisation.
• Fewer than 50 network tunnels and no Catalyst SD-WAN tunnels gives full eligibility. With more, or with Catalyst SD-WAN tunnels, Cisco asks you to discuss options with its account team, and a manual migration to a new instance may be needed.
• Umbrella for MSP packages are not eligible for the automated upgrade at the time of writing.

The workflow then runs in this order:

1. Create a Security Cloud Control account. Security Cloud Control (SCC) is Cisco's management platform for its security products. You sign up through Security Cloud Sign On, enrol in multi-factor authentication and add your Umbrella admins.
2. Activate the Upgrade Manager. In the Umbrella dashboard, request an invitation from the upgrade option on the licensing page, then claim your Secure Access subscription in SCC with the claim code from Cisco's welcome email. The admin must use the same email address in Umbrella and SCC, and must choose to attach the existing Umbrella instance rather than create a new one.
3. Complete the four prerequisites: enable Security Cloud Sign On for all users; update virtual appliances and Active Directory connectors; update Chromebooks and mobile devices; and update the SAML metadata.
4. Start the upgrade to copy policies and components into Secure Access.
5. Redirect traffic so networks, tunnels and devices are steered through Secure Access.
6. Close Umbrella, which permanently shuts down the Umbrella organisation and cancels the Umbrella subscription.

Getting the Secure Access licence right matters most here. Check that the tier covers everything you use in Umbrella today, including add-ons, before you buy.

Pre-migration audit checklist

Most migration problems come from things nobody remembered were configured. We audit these before any move:

• Policies: DNS policies, web policies, firewall rules, destination lists, content categories, block pages and bypass settings. See Umbrella content filtering.
• Identities: networks, roaming computers, Active Directory users and groups, Entra ID or Okta sync, and SAML. See Umbrella identities and SAML.
• Network tunnels: every IPsec tunnel from firewalls, routers and SD-WAN, with their IDs and redundancy, and whether any are Catalyst SD-WAN tunnels (which affects eligibility). See Umbrella IPsec tunnels.
• Roaming modules: which devices run the Umbrella Roaming Security Module in Cisco Secure Client, and how they are deployed. See the Umbrella roaming client page.
• Virtual appliances and AD Connectors: how many, where, and which internal domains they handle. See Umbrella virtual appliance.
• Chromebooks: whether you use Cisco Security for Chromebook and how it is deployed through Google Admin.
• Integrations: Cisco Meraki, SIEM, S3 log export, the Reporting API and Investigate API. See Umbrella reporting.
• Add-ons: RBI, DLP, L7 firewall, Reserved IP and Multi-Org, flagging any with no migration product.
• Admins and sign-in: who has Full Admin, which email addresses they use, and how they will sign in through Security Cloud Sign On.
• Multi-org structure: if you use the Umbrella multi-org console, each child organisation needs its own plan, and eligibility needs confirming with Cisco.

Pilot and cut-over

We migrate in stages so users notice as little as possible:

1. Agree the target design: tier, identities, policy structure and any changes you want to make while you move.
2. Buy and claim Secure Access, set up Security Cloud Control and activate the Upgrade Manager.
3. Complete the prerequisites, updating virtual appliances, AD connectors, Chromebooks, mobile devices and SAML metadata.
4. Run the upgrade, then compare the copied rules with the Umbrella audit and fix rule order.
5. Pilot with a small group: one site or a set of roaming users, checking resolution, filtering, block pages and reporting.
6. Move sites and tunnels one at a time. Cisco's Upgrade Manager copies Umbrella tunnels as network tunnel groups, but you build new IPsec tunnels to them, with a second address for the secondary hub and a new passphrase. Keep the previous path ready to fall back to.
7. Move roaming devices in waves through Intune, Group Policy, your RMM tool or Google Admin.
8. Check reporting and integrations, then close Umbrella once everything has moved.

Timing the cut-over against your Umbrella renewal date, and against the 31 January 2028 last renewal date, helps you get the most from any Cisco offer and avoid paying twice for longer than necessary.

Umbrella vs Secure Access

Secure Access builds on what Umbrella does rather than replacing the idea:

The biggest practical difference is Secure Private Access, which lets you give staff access to internal applications without a traditional VPN. If you only use Umbrella for DNS-layer protection, DNS Defense may be all you need. For the full product picture, see Cisco Secure Access and our vendor-neutral ZTNA guide. If you want to compare other platforms, see Check Point Harmony SASE or our guide to SASE.

Contact us to plan your migration. We will start with an audit and give you a clear plan and quote.

How Forever Systems supplies and supports Cisco Umbrella

We supply, deploy and support Cisco Umbrella for UK organisations, and plan the move to its successor, Cisco Secure Access.

• Package selection: DNS Security or SIG, Essentials or Advantage, plus add-ons, matched to your users, sites and compliance needs
• Deployment: network DNS forwarding, virtual appliances, the roaming module in Cisco Secure Client, Chromebooks, IPsec tunnels from Cisco Meraki and other firewalls, and Active Directory, Entra ID or SAML identity integration
• Policy design: security categories, content filtering for schools and businesses, allow and block lists, and reporting
• Migration planning from Umbrella to Cisco Secure Access ahead of Cisco's end-of-sale and end-of-support dates
• Ongoing support: reporting, policy tuning, renewals and licence changes

Forever Systems Ltd is an independent IT and cyber security provider and also supplies the wider Cisco Secure portfolio.

Frequently asked questions

Explore Cisco Umbrella

Related from Forever Group

• Cisco Secure Access
• Cisco Secure Client
• ZTNA explained
• Check Point Harmony SASE
• SASE explained
• Cisco Umbrella from Forever Group
• Microsoft Intune