In short: Cisco Umbrella MSP and multi-org consoles manage many Umbrella organisations from one place. The Multi-org console suits trusts, groups and franchises with a central IT team; the MSP console lets service providers manage customers, with co-branding and first-line support. Both share DNS security and content settings, and both are covered by Cisco's end-of-life notice.
Two consoles, two purposes
Each Umbrella organisation normally has its own dashboard, policies and reports. When you need to run several of them, Cisco offers two parent consoles:
| Multi-org console | MSP console | |
|---|---|---|
| Who it is for | Organisations with several parts but one security team | Managed service providers reselling Umbrella to customers |
| Typical users | Multi-academy trusts, college groups, franchises, groups of companies, universities with separate sites | IT service providers |
| Child organisations | Your own sites or business units | Your customers |
| Seats | Allocated from your total to each organisation, and moved as needs change | Bought by the MSP and allocated to customers; the licence is owned by the MSP |
| Support model | Your IT team, with Cisco or your provider behind it | The MSP gives first-line support and escalates to Cisco |
| Extras | Shared settings, central reports, local admins | As multi-org, plus PSA integration, delegated admin roles and a support contact |
Cisco also notes that the Multi-org console helps where a network has more than one Active Directory domain, because a single Umbrella dashboard supports one domain.
What you can manage centrally
Settings are built once in the parent console and shared to child organisations, where they apply to the default policy or to all policies, depending on how you share them. Cisco lists the shared settings as:
- destination lists (allow and block)
- block page appearances
- content category settings
- security category settings
- custom integrations and advanced settings
Advanced settings cover options such as SafeSearch and logging. A shared destination list is applied on top of any lists the child organisation has built itself. These are DNS-policy building blocks; anything outside that list, such as web policy rules for the Umbrella SIG packages, network tunnels and identity integration, is configured inside each child organisation. SAML user authentication is also set per child organisation, not at the parent console, although administrators can use single sign-on to log in to the console itself.
Central reports give a single view across every organisation: an Overview of activity volume and deployment health, a Deployment Status report counting networks, roaming clients and virtual appliances, and a Security Summary of traffic and security events. Detailed investigation happens in each organisation's own Umbrella reporting.
Administrators and access
The consoles separate central and local administration:
- Console administrators have full admin rights over every child organisation, so keep this group small and turn on two-step verification
- Local administrators are created inside one organisation and see only that organisation's dashboard, for example a school business manager who wants reports for their own school
- Delegated admin roles (MSP console): five roles that give staff narrower rights, such as managing customers without full console access, deploying software without changing settings, or updating centralised settings only
- Global Read Only (MSP console) can be combined with full admin rights on chosen customer dashboards
Both consoles keep an audit log of changes made at console level, such as adding an organisation or changing its seats, alongside each organisation's own Admin Audit Log. Console settings also include co-branding with your logo, a co-branded login page and API keys for the Console Reporting API; the Multi-org console adds S3 log management for every organisation's logs.
The MSP model in more detail
Umbrella for MSPs is designed for providers who blend Umbrella into a monthly managed service. Cisco built it to integrate with the ConnectWise and Autotask PSA platforms for ticketing and usage data, and the console provides the details needed to deploy the roaming module through a remote monitoring and management (RMM) tool. The MSP buys a pool of seats and allocates or reallocates them between customers; a customer's package cannot be changed from the console once it is set. Customers are identified only by an organisation name, which can be abbreviated for privacy.
MSP console administrators can open any customer's dashboard with full admin rights, without the customer having to grant access, which is why console admin accounts need careful control. Customers who have access to their own dashboard raise support requests with the MSP's support contact, not with Cisco. The MSP handles first-line support and can escalate to Cisco when needed. If you want to evaluate Umbrella first, see the Umbrella free trial.
End of life for multi-org and MSP
Cisco's end-of-life notice for Umbrella SIG and DNS includes the Multi-Org add-ons and the Service Provider versions. The milestones are the same as for the core packages: end of sale on 31 January 2027, last renewal or change on 31 January 2028 and last date of support on 31 January 2029. Every child organisation needs to be accounted for in a migration plan, since policies, identities and deployments live in each one.
Cisco's migration route is Cisco Secure Access. Before you plan a trust-wide or customer-wide move, audit each child organisation's settings and deployments as described in our Umbrella to Secure Access migration guide, and check the full Umbrella end of life timeline.
Umbrella as a managed service from Forever Systems
If you would rather not run Umbrella yourself, Forever Systems can manage it for you. A typical managed service covers policy design and changes, onboarding new sites and devices, roaming module and Chromebook deployment, responding to block and allow requests, monthly report reviews, renewals and migration planning. It suits multi-site organisations and schools and trusts that want central control without adding work to a small IT team.
Pricing depends on the package, the number of users and the level of service, so ask us for a quote. Contact us to discuss a multi-org set-up or a managed service.
How Forever Systems supplies and supports Cisco Umbrella
We supply, deploy and support Cisco Umbrella for UK organisations, and plan the move to its successor, Cisco Secure Access.
- Package selection: DNS Security or SIG, Essentials or Advantage, plus add-ons, matched to your users, sites and compliance needs
- Deployment: network DNS forwarding, virtual appliances, the roaming module in Cisco Secure Client, Chromebooks, IPsec tunnels from Cisco Meraki and other firewalls, and Active Directory, Entra ID or SAML identity integration
- Policy design: security categories, content filtering for schools and businesses, allow and block lists, and reporting
- Migration planning from Umbrella to Cisco Secure Access ahead of Cisco's end-of-sale and end-of-support dates
- Ongoing support: reporting, policy tuning, renewals and licence changes
Forever Systems Ltd is an independent IT and cyber security provider and also supplies the wider Cisco Secure portfolio.
Want a Cisco Umbrella quote, deployment or migration plan?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
What is the Cisco Umbrella multi-org console?
It is a parent console that manages several Umbrella organisations from one place. Each organisation keeps its own dashboard, while the console shares settings such as destination lists, block pages and content and security categories, allocates seats and provides central reports.
What is the difference between the Umbrella multi-org console and the MSP console?
The Multi-org console is for one organisation with several parts and a central IT team. The MSP console is for service providers managing customers: the MSP owns the licences, gives first-line support, can integrate a PSA and can assign delegated admin roles.
Can each school in a multi-academy trust have its own Umbrella admin?
Yes. Each school can be a child organisation with its own local administrators, who see only that school's dashboard, while the trust's central team manages shared settings and sees reports across every school.
Can SAML be configured in the Umbrella multi-org console?
SAML user authentication is configured in each child organisation rather than at the parent console. Administrators can still use single sign-on to log in to the Multi-org or MSP console itself, except on consoles that use a Cisco CEC login.
What happens to Umbrella multi-org at end of life?
Multi-Org add-ons and Service Provider versions are on Cisco's end-of-life notice, with end of sale on 31 January 2027 and last support on 31 January 2029. Each child organisation needs to be included in your migration plan.