Cisco's own migration doc says the Umbrella to Secure Access upgrade is a paid service that needs a Secure Access order first, a Security Cloud Control org, SAML sign-on, a 3 to 4 business day wait for a claim code, and ends with an irreversible Close Umbrella step. Here is the checklist from Cisco's documentation, what it costs you in time and architecture, and why many teams find switching to dope.security's on-device SWG is the shorter path.