Secure Access Migration Single Sign On Authentication Configuration with Cisco Cloud Sign-On

Issue

During the migration from Umbrella to Secure Cloud Control, administrative Single Sign-On (SSO) behavior changed unexpectedly. Instead of using the previously configured Microsoft Entra ID for authentication and MFA, administrators were required to authenticate using Cisco Cloud sign-on with DUO. This resulted in administrators being prompted to set new passwords and enroll in DUO for multi-factor authentication.

Environment

• Technology: Secure Access (formerly Umbrella)
• Migration: Umbrella to Secure Cloud Control
• Authentication: Microsoft Entra ID (Azure AD) configured as Identity Provider
• Multi-Factor Authentication: Microsoft 365 MFA previously configured
• New Authentication Method: Cisco Cloud sign-on with DUO

Resolution

The authentication migration from Microsoft Entra ID to Cisco Cloud sign-on is a mandatory step that occurs during the Secure Access migration process. The following steps should be followed to properly configure SAML UI authentication:

Step 1: Complete the Secure Access Migration

Complete the full Secure Access migration before attempting to configure SAML UI authentication in Secure Access. This ensures all components are properly migrated and ready for authentication configuration.

Step 2: Configure SAML Authentication via Security Cloud Control

SAML UI authentication configuration is now managed through the Security Cloud Control (SCC) interface rather than directly within Secure Access. Navigate to Security Cloud Control > Authentication Settings to access the identity provider configuration options.

Step 3: Review Identity Provider Configuration

Review and validate the identity provider configuration in the Security Cloud Control page. Ensure that the Microsoft Entra ID integration is properly configured for the new environment.

Cause

The authentication behavior change is part of the mandatory migration process from Umbrella to Secure Access. During this migration, the SAML authentication automatically transitions from Microsoft Entra ID to Cisco Cloud sign-on, which requires DUO for multi-factor authentication. This is a required architectural change in the new Secure Access platform where authentication settings are managed centrally through Security Cloud Control rather than within the individual product interfaces.

Related Content

• Integrating Identity Providers
• Cisco Technical Support & Downloads