Get Started with Single Sign-On

Umbrella supports Security Assertion Markup Language (SAML) for authentication. This allows you to provide single sign-on (SSO) access to your Umbrella dashboard.

SAML works for Umbrella the same way SAML does with all other service providers. From a high level, all the users in your organization have their authentication managed by the SSO, or identity provider (IdP). Umbrella establishes a trust relationship with the IdP and then allows them to authenticate and seamlessly log into Umbrella. Effectively, once a user has authenticated to the SSO IdP, they can automatically log in through the app (in the case of an IdP service).

Any changes made in your SSO provider are immediately synced with Umbrella. If you add an account or change a password in your SSO provider, it is immediately reflected in your login. Only the username (email address) is stored in Umbrella; however, the email must match between your SSO provider and the one used to login to Umbrella.

Note: SSO for Umbrella is only tied to authentication to the dashboard. It is not tied to the authorization for a user's access level within the Umbrella dashboard, such as whether the user is an Administrator or a Read-Only user. To learn about user roles, see Manage User Roles.

Prerequisites

• You must have administrator access to your Umbrella dashboard.
• If you are a multi-org admin, you must be a local admin to the child organization where SSO is being enabled.
• You must configure a SAML provider. We support Duo (preferred), Okta, OneLogin, Ping Identity and Azure SSO.
• You must have access to an inbox to accept the auto invite generated invitation. If you do not have the access, then contact Umbrella Support.

How SSO Changes Logging In

By changing the way in which users log into Umbrella, several key things will happen that you should be aware of.

• Block Page Bypass (BPB) Users will no longer work to bypass block pages or authenticate in any capacity to Umbrella. A BPB user is a user just like any other in Umbrella, but because of the way authentication is handled by SSO, it cannot be used to bypass block pages. Instead, you must use BPB codes. For more information, see Setting up a Block Page, a Block Page Bypass User, and a Block Page Bypass Code.
• If you update dynamic IPs, you will no longer be able to use the Updater client. Instead, cURL or wget can be used along with an update-only password which can be generated by Support. See Cisco Umbrella Dynamic Update API for more information. To get an update-only password, contact us at [email protected].
• When you enable SSO, every user with an account in your Umbrella organization will receive an email informing them to log in through your SSO provider. Only make the change when your organization's staff is ready to commit to the change.
• If a user is not configured in your SSO provider, they will not be able to log in until they are added to your SSO provider. Ensure that every user that needs to log in to the Umbrella dashboard is added to your SSO provider.
• If you disable SSO, every user of your Umbrella organization will receive an email asking them to reset their passwords. Previous passwords are not stored and must be reset.
• Changes to SSO cannot be made without disabling and re-enabling SSO.

Disable Cisco Security Cloud Sign On < Get Started with Single Sign-On > Enable SSO with Duo