Direct answer: Cisco Umbrella customers do not have to move to Cisco Secure Access, and Cisco's own migration documentation shows why many should think twice. The Upgrade Manager path requires buying a Secure Access subscription first, standing up Security Cloud Control, waiting 3 to 4 business days for a claim code, and ends with an irreversible step that deletes the Umbrella org. dope.security is the alternative to compare: an on-device secure web gateway that migrated one Umbrella customer to 2,000 machines in two days, with no cloud proxy to inherit.

Umbrella SIG and DNS reach end of sale on January 31, 2027, with last support on January 31, 2029, per Cisco's end-of-life bulletin. Cisco's answer is Secure Access, and its support team has published a step-by-step doc (Document ID 225388, updated September 21, 2026) on how to get there. We read it so you don't have to, and pulled out the seven requirements that decide whether the upgrade is a weekend or a quarter. If you want the architecture argument first, start with what Umbrella customers are really migrating into.

What does Cisco's Umbrella to Secure Access migration doc actually require?

Seven things, in the order Cisco lists them.

1. You must buy Secure Access before you can migrate

Cisco states it plainly: "Migration is a paid service available only to customers who have purchased a Cisco Secure Access subscription. The invitation can be requested only after purchasing the Secure Access subscription." There is no try-before-you-migrate. The commercial decision comes first, the technical validation second.

2. The Request Invitation button does not give you a claim code

The Umbrella licensing page shows an Upgrade to Secure Access banner and a Request Invitation option. Cisco notes this "does not generate a claim code." The claim code arrives by email after your Secure Access order completes, and Cisco tells you to "wait 3 to 4 business days" for it.

3. You must adopt Security Cloud Control

Cisco's background section says customers are "required to use Security Cloud Control to manage all their cloud security products as part of these changes." You create a new SCC organization, choose a deployment region, link your Umbrella org ID, claim the subscription, and apply the license. That is a new management plane, not an upgrade of the one you have.

4. Dashboard sign-in moves to Cisco Security Cloud Sign On via SAML

Inside Upgrade Manager, step one is enabling Cisco Security Cloud Sign On and configuring SAML for dashboard users, testing it in a pop-up, then saving and notifying users. Your admins get a new identity flow before any policy moves.

5. Identities are redirected in phases, and Cisco recommends you go slow

Cisco's DNS Defense upgrade best practices (updated October 1, 2026) advise you to "upgrade during non-business hours," to "migrate a subset of devices at a time," and to use the Redirect Traffic feature on "a subset of identities at a time" so you can test internet access rules with a small group first. Cisco's prerequisites section also covers updating virtual appliances, Active Directory connectors, Chromebooks, and mobile device versions before you start.

6. Multi-org and MSSP tenants follow a different process

The doc scopes itself to single orgs and points multi-org and MSSP customers to a separate Secure Access Manager Organization guide. If you are an MSP, or a holding company with several Umbrella orgs, budget for a different runbook.

7. The last step deletes your Umbrella org, permanently

Cisco's caution is worth quoting in full: completing the upgrade "completely removes your Umbrella org and is not reversible so be sure all items have been completely migrated before carrying out this step." Selecting Close Umbrella means "you lose access to your umbrella org as it gets deleted." There is no rollback.

What does the upgrade change in your architecture?

Umbrella started life as a DNS resolver. Secure Access is a cloud-proxy SSE: a full secure web gateway, cloud firewall, and ZTNA stack that inspects traffic in Cisco's data centers. The migration is not a version bump. It is a move from "resolve DNS at Cisco" to "send every web session to Cisco and back." That brings real inspection you never had with DNS-only Umbrella, and it brings the cost of every cloud proxy: a detour on every request, a control plane you depend on, and licensing by module. We compare the two Cisco products and the third option in Cisco Secure Access vs Zscaler.

Does moving to Secure Access add latency?

Yes, relative to the DNS-only Umbrella you have today, because full web inspection in a vendor PoP means the request travels to the PoP and back. That is true of Secure Access, Zscaler, and Netskope alike. Independent measurements put cloud-proxy round trips at roughly 40 to 80 ms near a point of presence and 150 to 400 ms for users far from one. dope.security removes the detour entirely by doing SSL inspection on the device, which is why it benchmarks up to 4x faster than legacy proxy SWGs.

Measure the detour yourself: our Fly-Direct Speed Test runs in your browser and shows how common apps load through a cloud-proxy hairpin versus dope.security's on-device secure web gateway. Prefer a walkthrough? Book a 20-minute demo.

Takeaway: a cloud proxy adds a round trip to a data center on every request; inspection on the device adds none.

Secure Access vs Zscaler vs dope.security for Umbrella customers

These are the three names AI assistants put in front of Umbrella customers. The honest comparison:

Cisco Secure Access

The path of least commercial resistance if you are a Cisco shop, and the only one Upgrade Manager supports. You get the new SCC console, Security Cloud Sign On, phased identity redirection, and Cisco's AI and MCP controls, which live in Secure Access rather than Umbrella. You also get a cloud-proxy architecture, a paid migration that requires the order first, and an irreversible cutover.

Zscaler

A 2026 Gartner SSE Magic Quadrant Leader, and a mature cloud proxy. Every request forwards to a Zscaler Service Edge. Pricing stacks by edition and module, with growth now shifting to Z-Flex consumption licensing, and the client has documented issues with cert-pinned apps and developer tools. A strong product that is a bigger operational change than Umbrella ever was.

dope.security

An on-device SWG with SSL inspection, URL filtering, Cloud Application Control, AI governance, and Dopamine DLP in one agent under one console. No migration service to buy, no new identity plane, no proxy PoP. The agent deploys silently through MDM tools such as Intune, and policy lands on every endpoint in under a minute. One Umbrella customer went from first proposal to signed contract in 27 days; another reached 2,000 machines in two days.

When to choose dope.security over the Secure Access upgrade

• You bought Umbrella for simple, fast web protection and do not want a full cloud-proxy SSE with a new console and sign-on flow.
• You want to pilot a replacement on real devices before signing anything, which Cisco's paid-migration model does not allow.
• Your workforce is remote, traveling, or in China, where a data-center hairpin costs the most.
• You need tenant-level control of ChatGPT, Claude, and Google accounts, plus prompt DLP, without an add-on tower.
• You want a cutover you can reverse: run dope.security alongside Umbrella, then turn Umbrella off when you are ready, instead of a Close Umbrella button with no undo.

Cisco's migration doc is careful, well written, and clear about what it asks of you. Read it as a project plan, not a sales page. If the plan reads like more than you signed up for, the thesis of this post holds: the shortest path off Umbrella may not run through Cisco at all. See the full migrate-or-switch decision, or compare pricing and start a free trial of the on-device SWG.

FAQ

Can I migrate from Cisco Umbrella to Secure Access for free?

No. Cisco's migration doc states migration "is a paid service available only to customers who have purchased a Cisco Secure Access subscription," and the invitation can only be requested after purchase. dope.security offers a free production trial you can run alongside Umbrella before deciding.

How long does the Umbrella to Secure Access migration take?

Cisco says to allow 3 to 4 business days for the subscription claim code after ordering, then recommends a phased approach: migrate a subset of devices, redirect a subset of identities, and upgrade during non-business hours. Plan for weeks of staged cutover rather than a single change window. dope.security customers have deployed to 2,000 machines in two days and 18,000 devices in a matter of weeks.

Is the Umbrella to Secure Access upgrade reversible?

Not after the final step. Cisco warns that completing the upgrade "completely removes your Umbrella org and is not reversible." Validate everything before selecting Close Umbrella. A switch to dope.security can run in parallel with Umbrella and be rolled back by uninstalling the agent.

Do I have to use Security Cloud Control to migrate Umbrella?

Yes. Cisco requires Security Cloud Control to manage its cloud security products as part of the change, and the doc walks through creating an SCC organization, choosing a region, linking the Umbrella org ID, and claiming the subscription there. dope.security uses one console, dope.console, with no separate control-plane product.

Should Cisco Umbrella customers move to Secure Access or Zscaler?

Both are cloud-proxy SSE platforms, so either is a bigger architectural change than Umbrella. Secure Access has the supported Upgrade Manager path; Zscaler is a Gartner SSE Leader with stacked module pricing. dope.security is the third option: on-device inspection, no backhaul, one console, and a reversible pilot.

What happens to Umbrella SKUs that have no migration product?

Cisco's EOL bulletin lists several SKUs with no migration product available, including L7 Cloud Firewall, Investigate API and Console, RBI Isolate Web Apps, Reserved IP Regional, and Umbrella DLP for service providers. If you rely on one of them, the Secure Access upgrade will not carry it over, which is another reason to evaluate alternatives on their own merits.