Troubleshoot Meraki Profile Not Appearing in the Umbrella Link to Meraki Function for iOS CSC

Introduction

This document describes how to troubleshoot your Meraki profile not appearing in the Umbrella "Link to Meraki" function for the iOS Cisco Security Connector (CSC).

Overview

This article is intended for users whose Meraki profile fails to appear in the "Link to Meraki" function in their Umbrella mobile device. Linking to Meraki is the first step in using the iOS CSC with the Meraki MDM. 

Symptoms

The most common symptom is that the expected target Meraki MDM profile does not appear when linking to Meraki from Umbrella. A 403 error toast message at the bottom of the screen is also generated. The desired policy does not appear in the highlighted area shown below, or can appear as a blank list.  

360000301746

Root Cause

In most cases, the root cause is due to one of these two causes:

• Meraki API key is incorrect: Please validate your API key from your Meraki Dashboard. Go to the main page and click your username at the top right, then select "My Profile". Your API key is listed on this page.
• Meraki API key does not have sufficient API access: To validate, use the steps below:
  1. From within the Meraki Dashboard, navigate to Help > API Docs at the top right of the page.
  2. Does the 'List all the profiles in the network' subsection appear in the API Docs? If not, then your account does not have access to this call and this must be resolved on the Meraki side. One common cause is that automated free trials do not receive this access. 
     
     • No access example: 
       360000297283
     • Access example:
       360000301826

Conclusion

When Meraki profiles do not appear on the Mobile Devices Meraki link MDM page, the root cause is typically associated with the Meraki API key used. Since Cisco Umbrella is pulling profile data from Meraki using the user's API key to this API call, we can only return what the key has access to see. Any 403 access errors from the Umbrella dashboard would be expected if the "List all the profiles in the network" API call is not allowed on an account.