Cisco Cloud Control Getting Started

Cisco Cloud Control is the unified operations platform for AgenticOps. It brings every Cisco domain into one consistent environment, enabling teams to proactively manage, govern, and operate across the full IT estate from a single experience. The platform simplifies management by offering a single operational interface that complements existing Cisco product controllers, reducing complexity and improving efficiency for IT operations. It enables seamless cross-domain workflows and a consistent user experience without replacing individual product dashboards.

By bringing together inventory, topology, actions, identity, and workflows, Cisco Cloud Control gives operators the context and tools to understand their environment, investigate issues across domains, and take action within one operating experience. AI Assistant provides a natural-language entry point for asking questions, understanding the environment, and starting an investigation. When an issue requires more context or a coordinated investigation, AI Canvas provides a shared operational workspace where teams and AI agents work together to investigate and take action to resolve it.

Cisco Cloud Control is Generally Available in the United States only. Support for additional regions will be added in future milestones.

To get started with Cisco Cloud Control, complete the following tasks:

After completing the onboarding, refer to Cisco Cloud Control Overview for an overview of the Cisco Cloud Control Home page, platform services, and capabilities.

Product-specific prerequisites are listed under each product. Complete the prerequisites for the products you plan to onboard into Cisco Cloud Control.

If a product is not listed in this section, no additional product-specific prerequisites are required.

Meraki

Meraki provides cloud-managed networking and centralized management for distributed network infrastructure.

Additional configuration for IdP-initiated SAML login

If your organization uses IdP-initiated SAML login, where users start from an IdP-hosted dashboard that includes a Meraki application tile, ensure your organization’s SAML login URL is configured in Meraki.

1. Have an administrator sign in to Meraki and go to Organization > Settings > Authentication > SSO Login URL.

2. Confirm that the SSO Login URL field is populated. If it is empty, contact your IdP admin to obtain the "SSO Login URL" for Meraki. Enter the URL in the SSO Login URL field, then select Save.

For more information, refer to Provide your IdP’s SSO Login URL.

Meraki users with SAML SSO must verify their email

If you sign in to the Meraki dashboard using Security Assertion Markup Language (SAML) single sign-on (SSO), complete the following email verification steps to enable access to Cisco Cloud Control using your existing SAML authentication.

---

This procedure applies only to users who sign in to the Meraki Dashboard using SAML SSO. It doesn’t apply to users who sign in with a local Meraki username and password.

---

1. Sign in to Meraki using your SAML login.

   

2. Select Verify email to confirm the email address you will use to access Cisco Cloud Control.

3. Enter the email address for the Cisco account you’ll use to sign in to Cisco Cloud Control.
   Make sure you can receive email at this address, as a verification code will be sent to it.
   The email address you verify should:

   • Be your primary business email address.

   • Be associated with your Cisco account and will be used to sign in to Cisco Cloud Control.

   • Match the email address you use with other Cisco products you want to manage through Cisco Cloud Control.

     

     ---

     Your SAML login username may not be an email address. For example, some organizations use an employee ID or username to authenticate with their Identity Provider (IdP). During the verification step, always enter your Cisco-associated email address. For many organizations, this is also the email address used to sign in to the IdP Portal page.

     ---

4. Complete email verification by entering the code sent to your email address.

---

Troubleshoot SAML email verification

If you encounter the userNameType must be accountName error during email verification, both of these conditions might apply:

• Your SAML user record has been flagged by Cisco Cloud Control onboarding as not yet verified or invalid.

• You are a local Meraki admin using an email address that Meraki has verified.

Meraki does not allow the same email address for both a local account and a SAML account. Additionally, while Meraki does not require SAML users to have a valid email address, Cisco Cloud Control does. The error occurs when the email address matches one already associated with a verified local user.

To resolve the error:

1. Delete your local user if it is no longer used. For more information, refer to Delete a Meraki-hosted User.

2. If you need to keep the local user—for example, because you use it to generate API keys—edit its email address using plus addressing, also called subaddressing. SAML users cannot create API keys. Plus addressing creates an alias based on your existing email address.

   Email address changes can take up to five minutes to sync.

   To use a plus-addressing alias:

   1. Log in to the Meraki Dashboard using your local user credentials.

   2. Select My Profile.

   3. Under Your email address, change the email address to use the alias. For example, change name@company.com to name+alias@company.com, where alias is any text you choose.

      For more information, refer to:

      • Plus addressing in Exchange Online

      • Plus addressing in Google Workspace

3. After resolving the email conflict, repeat the email verification process. If you changed the local user’s email address, use the updated address in Step 3.

---

Splunk Cloud

The Splunk integration with Cisco Cloud Control provides single sign-on, cross-launch between platforms, access to Splunk data and skills in AI Canvas, and Splunk AI Assistant capabilities through the Cisco Unified AI Assistant.

Before onboarding or connecting Splunk Cloud Platform to Cisco Cloud Control, confirm the following:

• Splunk Cloud Platform stack runs version 10.5 or later.

• Splunk Cloud stack is hosted on US Commercial AWS.

  Future Support: GCP, Azure, FedRamp, Gov Cloud

• A Splunk user with the “sc_admin” role must:

  1. Install the latest versions of the following apps:

     1. Splunk MCP Server

     2. Splunk AI Assistant

  2. Assign the mcp_tool_execute capability to every role that requires Splunk access in AI Canvas.

     Navigate to Splunk Cloud Home > Settings > Roles > Capabilities to assign it.

• Splunk users must verify their email addresses to complete their migration to Cisco Unified Identity.

  1. Version 10.5: Contact your sales team to enable email verification.

  2. Version 10.6 or later: Email verification is enabled by default when users log in.

---

• Identify any PCI, HIPAA, or other compliance requirements that may require reviewing the applicable Cisco terms.

• For Splunk customers in the AWS US East region, identify any regional data requirements before connecting your Splunk environment to Cisco Cloud Control in the US West region.

---

Cisco Cloud Control supports these browsers:

If you encounter issues when cross-launching Intersight, Meraki, or ThousandEyes from Firefox, use a private window.

Onboarding associates the Cisco products you want to manage with Cisco Cloud Control. You sign in using one of those products, link the tenants you want to include, and create a tenant group. A tenant is an isolated set of data within an organization. Depending on the product, a tenant may be an organization, account, network, stack, or another product-specific entity. A tenant group brings together at least two product tenants so your team can manage them as a single logical environment in Cisco Cloud Control.

Before you complete these steps, ensure that at least one common admin user with the same email address is configured across all products. This user can log in to Cisco Cloud Control and complete initial tenant linking and onboarding.

After onboarding, only users with admin privileges for a product (such as Meraki) can access the Tenants page in the Admin Console to configure a Cisco Cloud Control tenant linked to that product.

The procedures in this section are required only for the products listed here.

Connect Nexus Dashboard with Intersight

Connect a Nexus Dashboard instance to Cisco Cloud Control through Intersight to enable data sharing.

---

If the Nexus Dashboard instance you want to add is already connected to Intersight, you do not need to complete this procedure. You only need to connect the associated Intersight tenant to Cisco Cloud Control.

---

Before you begin, ensure that:

• At least one Intersight tenant is configured in Cisco Cloud Control.

• You have the necessary permissions to claim a target device.

Follow the steps to connect the Nexus Dashboard instance to Cisco Cloud Control through Intersight. You can repeat these steps to add additional Nexus Dashboard instances to the same Intersight tenant.

1. Log in to Nexus Dashboard directly, and select Admin > Nexus Dashboard management > Intersight.

   

2. Copy the device ID and claim code listed for your instance.

3. In Cisco Cloud Control, launch Nexus Dashboard.

4. From the left navigation, select Clusters.

5. Select Add Cluster.

   The wizard opens to guide you through connecting your Nexus Dashboard instance to Cisco Cloud Control through Intersight.

6. Select Continue.

7. Enter the device ID and claim code for your instance, and then select Continue.
   By default, the Nexus Dashboard instance is claimed by the Cisco Cloud Control tenant that you used to launch Nexus Dashboard.

   Your instance now appears on the Nexus Dashboard’s Clusters page.

Complete the required steps for each product whose data you want to make available in AI Canvas.