Cisco Secure Access Documentation Changes

PDF

Cisco Secure Access Documentation Changes

Cisco Secure Access Documentation Changes 2026-11-02

Updated: November 2, 2026

Want to summarize with AI?

Log in

Lists changes to Cisco Secure Access documentation published on November 2, 2026.

Summary

Changed Pages

Limitations and range limits

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/introduction-secure-access-intro/limitations_and_range_limits.html

  • Added: Note You can use 198.18.0.0/15 network with the Secure Access internal networking fabric, in client IP pools, and for private resources.

  • Added: Keep it blocked for all other use cases.

Endpoint Data Center Selection

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/introduction-secure-access-intro/Endpoint_Data_Center_Selection.html

  • Removed: It uses the public IP of the client (embedded in EDNS Client Subnet data) as well as the org ID (implicitly looked up via network registration, or gathered explicitly if embedded in the FQDN).

  • Removed: For geolocation, a dynamic lookup is performed against IP-to-location services to detect the source country of the user.

  • Removed: You can ues GeoLB to apply the following:

  • Added: You can use GeoLB to apply the following:

  • Removed: Country Ring-fencing: Keeping user traffic within national borders or preferred neighboring countries where possible.

  • Removed: Note This is a best-effort feature, and subject to the accuracy of the geolocation of the public IP of the client.

Security Insights Dashboard

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/dashboards-overview-intro/security-insights-dashboard.html

  • Removed: Threat

  • Added: Threats

  • Added: Set Background Theme

  • Added: Set the user interface theme to light theme, dark theme, or to adopt the theme your browser uses.

  • Removed: Threat Tab

  • Removed: The Threat tab of the Security Insights dashboard helps you identify where Secure Access blocks threats, where policy allows threats, and which rules, destinations, categories, or users require follow-up.

  • Added: Threats Tab

  • Added: The Threats tab of the Security Insights dashboard helps you identify where Secure Access blocks threats, where policy allows threats, and which rules, destinations, categories, or users require follow-up.

  • Added: Set Background Theme

  • Added: This procedure describes how to set the user interface theme of Secure Access to light theme, dark theme, or to adopt the theme your browser uses.

  • Added: Most integrated products and platform pages in Secure Access use the theme you set.

  • Added: Procedure

  • Added: From the home page of Security Cloud Control or any integrated product page, click the user menu and select Edit user settings

  • Added: In the System settings area, choose from:

  • Added: Light theme

  • Added: Dark theme

  • Added: System theme - The system theme adopts the theme your browser uses.

  • Added: Here is an example of Security Cloud Control using the dark theme:

Routing Options and Guidelines for Network Tunnel Groups

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/manage-network-infrastructure-intro/routing-options-and-guidelines.html

  • Added: BGP route filtering per network tunnel group

  • Added: BGP route filtering per network tunnel group (NTG) is a Cisco Secure Access feature that enables administrators to control, from the cloud and client, which routes are accepted from or advertised to each BGP-enabled NTG.

  • Added: This allows for granular security, compliance, and optimization without editing filters on individual branch devices.

  • Added: By default, Cisco Secure Access advertises all known routes to all BGP-enabled NTGs and accepts all prefixes from branch peers.

  • Added: This can lead to excessive routing table entries, security risks, and operational complexity.

  • Added: Route filtering per NTG solves these problems by allowing centralized, per-peer control over which IP prefixes are accepted or advertised, using simple cloud-based configuration.

  • Added: Benefits

  • Added: Centralizes control with a single interface for route filtering across multiple NTGs.

  • Added: Reduces operational overhead by eliminating per-device BGP filter management.

  • Added: Improves security and compliance by isolating sensitive or rogue routes.

  • Added: Optimizes routing behavior and network performance by selective advertisement.

  • Added: Sample use cases

  • Added: Some of the use cases for the route filtering feature include:

  • Added: Selective advertisement: Only advertise necessary routes to certain branches.

  • Added: Partner route protection: Prevent overlap or rogue routes from external partners.

  • Added: Region-based segmentation: Restrict route propagation to NTGs in a specific geography.

  • Added: Compliance assurance: Ensure sensitive subnets are never advertised to unauthorized branches.

  • Added: Types of route filtering

  • Added: Filtering can be applied in two directions:

  • Added: Client or Ingress filtering: controls which routes received from branches are accepted into Secure Access.

  • Added: Cloud or Egress filtering: controls which routes Secure Access advertises to branch devices.

  • Added: Filter modes

  • Added: Equal to: Filters only the specified prefix match.

  • Added: For example, 10.10.5.0/24.

  • Added: Less than: Filters the specified prefix and any sub-prefixes under it.

  • Added: For example, /24 rule applies also to /25, and /26 within that /24 subnet.

  • Added: BGP route filter parameters and limits

  • Added: This section lists the parameters, match options, limits, and supported values for BGP route filters per network tunnel group in Cisco Secure Access.

  • Added: Table 4.

  • Added: Route filter parameters

  • Added: Parameter

  • Added: Description

  • Added: Allowed Values

  • Added: Default

  • Added: Direction

  • Added: Filter direction: ingress (client) or egress (cloud)

  • Added: ingress, egress

  • Added: -

  • Added: Prefix/Subnet

  • Added: IP prefix in CIDR notation to filter

  • Added: IPv4 or IPv6 prefix

  • Added: For example, 10.10.5.0/24

  • Added: -

  • Added: Match Mode

  • Added: How the prefix is matched

  • Added: Equal to

  • Added: Less than

  • Added: Equal to

  • Added: Action

  • Added: Permit (allow) or deny (block)

  • Added: Allow, Deny

  • Added: Depends on the direction

  • Added: Target NTGs

  • Added: One or more NTGs by name where the filter needs to be applied

  • Added: Multi-select

  • Added: -

  • Added: Table 5.

  • Added: Route filter limits

  • Added: Limit

  • Added: Value

  • Added: Maximum filters per organization

  • Added: 1000

  • Added: Bulk action limit

  • Added: Up to 5 per operation

  • Added: Supported tunnel types

  • Added: BGP-enabled NTGs only

  • Added: Propagation Delay

  • Added: 1 – 2 minutes

  • Added: This is the time for a new filter to take effect.

  • Added: Restrictions for BGP route filtering per NTG

  • Added: You cannot configure the BGP route filtering feature on static NTGs, and on NTGs with multi-region backhaul (MRB) enabled.

  • Added: Key considerations

  • Added: Filtering and summarization: Plan the interaction between filters and route summarization.

  • Added: Filtering is always evaluated before summarization and may prevent a summary from being advertised if all child prefixes are filters out or denied.

  • Added: Allowed overlapping filters:

  • Added: Overlapping filters that have different prefix length, say less than /24 and /23, where the more specific prefix takes priority.

  • Added: Overlapping filters that have the same prefix length, say /24 and /24, only if there are no overlapping NTGs

  • Added: Filter modification: You can modify the filter action while editing the rule.

  • Added: You cannot change the filter from client filter to cloud filter or the other way around by editing.

  • Added: Review the impact of filter changes using the per-NTG and global route tables before and after deployment.

  • Added: Configure BGP route filters per NTG

  • Added: Use this procedure to configure BGP route filters per NTG to control which routes are accepted from or advertised to BGP peers.

  • Added: Before you begin

  • Added: Ensure you have at least one BGP-enabled NTG in Cisco Secure Access.

  • Added: Verify that you have sufficient privileges to modify Traffic Management and route filters.

  • Added: Decide which prefixes, and match modes you want to allow or deny.

  • Added: Procedure

  • Added: Navigate to Connect> Traffic Management> Route Filters in the Secure Access UI.

  • Added: Choose the filter type:

  • Added: Choose Client filters for ingress filters that control which routes are accepted from the branch.

  • Added: They support both allow and deny filter actions.

  • Added: Choose Cloud filters for egress filters that control which routes are advertised to the branch.

  • Added: They support only deny filter action.

  • Added: Click Add Filter.

  • Added: A side panel Add client filter or Add cloud filter opens.

  • Added: Figure 1.

  • Added: Add client filter panel

  • Added: Enter a filter name.

  • Added: Specify the Subnet/Prefix.

  • Added: Enter the prefix in CIDR notation.

  • Added: For example, 10.10.5.0/24.

  • Added: Select a match mode: Less than or Equal to.

  • Added: Set the Action as Allow or Deny.

  • Added: Allow: Permits only the specified NTGs.

  • Added: By default, it denies all other NTGs in this case.

  • Added: Deny: Blocks only the specified NTGs.

  • Added: By default, it allows all other NTGs in this case.

  • Added: Select the target NTGs by name.

  • Added: You can select multiple NTGs.

  • Added: Review your settings.

  • Added: Click Save.

  • Added: (Optional) Apply a bulk action.

  • Added: You can select up to five filters and choose Change Action or Delete.

  • Added: (Optional) Apart from the steps listed above, you can also apply route filters while creating a new NTG.

  • Added: Navigate to Secure Access> Connections> Network Connections> Network Tunnel Groups> Add a Network Tunnel Group to create a new NTG.

  • Added: In the Route Filters section, select the subnets to be filtered.

  • Added: Select the filter actions to be applied.

  • Added: Click Save.

  • Added: Verify BGP route filtering configuration

  • Added: Procedure

  • Added: Navigate to Connect> Traffic Management> Route Filters> Client Filters> or> Cloud Filters to check the filter status after adding a new filter.

  • Added: The table lists the newly created filter.

  • Added: Hover over the respective subnet entry for the filter to view the status.

  • Added: The initial status shows as In Progress, Filter is being created.

  • Added: At this stage, you cannot edit the filter.

  • Added: You can either delete the filter or view the details.

  • Added: Click on the ellipses (…) on the right corner of the filter table to perform these actions, if required.

  • Added: After a few minutes, the filter status finally changes to Active when all the NTGs have the rule configured.

  • Added: Click on the respective filter subnet listed in the Route Filters table to view the route filter information and filter action details.

  • Added: Figure 2.

  • Added: Route filter details

  • Added: View Network Tunnel Group Details to check the pre- and post-filter route count for client or cloud routes.

  • Added: Navigate to Secure Access> Connections> Network Tunnel Groups> <NTG-name>> Routing> Client Routes> or> Cloud Routes to verify if the intended prefixes are shown as allowed or denied in the route table per NTG.

  • Added: Verify that the denied routes do not appear in the client or cloud route tables accordingly.

  • Added: Use the audit and log features to verify filter propagation, especially after bulk changes or when route counts are unexpectedly low.

Configure Tunnels with Cisco Catalyst SD-WAN

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/network-tunnels-by-device-intro/configure-tunnels-with-cisco-catalyst-sd-wan.html

  • Removed: Under SIG Provider select Device Types, click the Genric radio button.

  • Added: Under SIG Provider select Device Types, click the Generic radio button.

  • Removed: In the API url endpoint, enter the API URL for the SIG endpoint of the tunnel.

  • Added: In the API URL endpoint, enter the API URL for the SIG endpoint of the tunnel.

  • Removed: IKE ID for local End point: Tuneel Group ID on SSE page.

  • Added: IKE ID for local End point: Tunnel Group ID on SSE page.

Configure Automatic Tunnels with Catalyst SD-WAN

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/network-tunnels-by-device-intro/configure_automatic_tunnels_with_catalyst_sd-wan_overview.html

  • Removed: Comand Line Interface (CLI) Commands

  • Added: Command Line Interface (CLI) Commands

Manage Resource Connectors and Connector Groups

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/resource-connectors-groups-intro/manage_resource_connectors_and_connector_groups.html

  • Added: Standard_D4as_v5 (4 vCPU, 16 GiB)

  • Removed: Note: For Disks, Networking, Management, Monitoring, and Tags, you can modify the settings for you cloud environment or keep the default selections.

  • Added: Note: For Disks, Management, Monitoring, and Tags, you can modify the settings for you cloud environment or keep the default selections.

  • Added: Click the Networking tab and check the Enable accelerated networking checkbox.

  • Added: This supports the Standard_D4as_v5 instance type.

  • Added: Note: Enable Accelerated Networking on the connector VM's network interface.

  • Added: In the Azure portal, select Enable accelerated networking on the Networking tab when you create the VM.

  • Added: Accelerated Networking improves network throughput and reduces CPU load on the connector.

  • Added: To enable it on an existing connector VM use the following steps:

  • Added: Stop the VM so that its status is Stopped.

  • Added: Restarting the VM is not enough.

  • Added: Open the VM's network interface, then enable Accelerated networking.

  • Added: Start the VM.

  • Added: You can confirm the setting with the Azure CLI: az network nic show -g -n --query enableAcceleratedNetworking.

  • Added: The output is true when Accelerated Networking is enabled.

Troubleshoot Resource Connectors and Connector Groups

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/resource-connectors-groups-intro/troubleshoot_resource_connectors_and_connector_groups.html

  • Added: Note: If you are using Standard_D4as_v5 instance type and intend to enable Accelerated Networking, rebooting does not push changes.

  • Added: Enable Accelerated Networking on the connector VM's network interface.

  • Added: In the Azure portal, select Enable accelerated networking on the Networking tab when you create the VM.

  • Added: Accelerated Networking improves network throughput and reduces CPU load on the connector.

  • Added: To enable it on an existing connector VM:

  • Added: Stop the VM so that its status is Stopped.

  • Added: Restarting the VM is not enough.

  • Added: Open the VM's network interface, then enable Accelerated networking.

  • Added: Start the VM.

  • Added: You can confirm the setting with the Azure CLI: az network nic show -g <resource-group> -n <nic-name> --query enableAcceleratedNetworking.

  • Added: The output is true when Accelerated Networking is enabled.

About Key Admin API Keys

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/manage-api-keys-intro/add_keyadmin_api_keys.html

  • Removed: In the dialog window, click Delete to confim the removal of the Key Admin API key.

  • Added: In the dialog window, click Delete to confirm the removal of the Key Admin API key.

Manage User Authentication Profiles

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/user-auth-profiles-intro/manage_user_authentication_profiles.html

  • Removed: Note When you add the Cisco User Management Connector application to your IdP, the connector app only suppports SAML.

  • Added: Note When you add the Cisco User Management Connector application to your IdP, the connector app only supports SAML.

Configure Integrations with SAML Identity Providers

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/saml-identity-providers-intro/configure_integrations_with_saml_identity_providers.html

  • Removed: SAML transfers data between the identity provider and the sevice provider; authentication is required to protect both the user's identity and the user's access to resources through single sign-on actions.

  • Added: SAML transfers data between the identity provider and the service provider; authentication is required to protect both the user's identity and the user's access to resources through single sign-on actions.

  • Removed: If applicable, add IdP metdata to Secure Access.

  • Added: If applicable, add IdP metadata to Secure Access.

  • Removed: To reconfigure SAML in Secure Accss, upload IdP metadata containing at least one public key.

  • Added: To reconfigure SAML in Secure Access, upload IdP metadata containing at least one public key.

  • Removed: Without SAML 2.0 the serice provider does not verify incoming SAML responses are signed with the configured IdP and this can open your environment to malicious attacks.

  • Added: Without SAML 2.0 the service provider does not verify incoming SAML responses are signed with the configured IdP and this can open your environment to malicious attacks.

Configure Microsoft Entra ID for SAML

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/saml-identity-providers-intro/configure_microsoft_entra_id_for_saml.html

  • Removed: Note When you add the Cisco User Management Connector application to your IdP, the connector app only suppports SAML.

  • Added: Note When you add the Cisco User Management Connector application to your IdP, the connector app only supports SAML.

Configure Okta for SAML

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/saml-identity-providers-intro/configure_okta_for_saml.html

  • Removed: Note When you add the Cisco User Management Connector application to your IdP, the connector app only suppports SAML.

  • Added: Note When you add the Cisco User Management Connector application to your IdP, the connector app only supports SAML.

Configure AD FS for SAML

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/saml-identity-providers-intro/configure_ad_fs_for_saml.html

  • Removed: Note When you add the Cisco User Management Connector application to your IdP, the connector app only suppports SAML.

  • Added: Note When you add the Cisco User Management Connector application to your IdP, the connector app only supports SAML.

Configure Duo Security for SAML

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/saml-identity-providers-intro/configure_duo_security_for_saml.html

  • Removed: Note When you add the Cisco User Management Connector application to your IdP, the connector app only suppports SAML.

  • Added: Note When you add the Cisco User Management Connector application to your IdP, the connector app only supports SAML.

Configure Ping Identity for SAML

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/saml-identity-providers-intro/configure_ping_identity_for_saml.html

  • Removed: Note When you add the Cisco User Management Connector application to your IdP, the connector app only suppports SAML.

  • Added: Note When you add the Cisco User Management Connector application to your IdP, the connector app only supports SAML.

Configure OpenAM for SAML

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/saml-identity-providers-intro/configure_openam_for_saml.html

  • Removed: Note When you add the Cisco User Management Connector application to your IdP, the connector app only suppports SAML.

  • Added: Note When you add the Cisco User Management Connector application to your IdP, the connector app only supports SAML.

Manage Global Settings for Access Rules

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/access-policies-intro/manage_global_settings_for_access_rules.html

  • Added: Disable Decryption for Specific sources

  • Added: Configure Decryption for Specific Sources

  • Added: To exclude specific internet traffic from decryption, add source IP addresses or Classless Inter-Domain Routing (CIDR) blocks.

  • Added: This setting applies to internet access rules.

  • Added: Before you begin

  • Added: You must have Full Admin user role.

  • Added: For more information, see Manage Accounts.

  • Added: Procedure

  • Added: Click Rule Defaults and Global Settings, and then select the Global Settings tab.

  • Added: Under Disable decryption for specific sources, click Add/edit sources.

  • Added: In the Disable decryption for specific sources panel, enter the source IP addresses or CIDR blocks in the Add sources field.

  • Added: Click + Add.

  • Added: The source count updates and the added sources appear in the list.

  • Added: (Optional) In the Search sources field, enter an IP address or CIDR block to filter the list.

  • Added: (Optional) To modify an existing entry, click the Edit (pencil) icon next to the source.

  • Added: (Optional) To remove a source, click the Delete (trash can) icon next to the source.

Manage Destination Lists

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/internet-saas-resource-intro/manage_destination_lists.html

  • Removed: Click Canel if you want the destination list to remain.

  • Added: Click Cancel if you want the destination list to remain.

Manage Content Category Lists

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/internet-saas-resource-intro/manage-content-categories.html

  • Removed: Use the followng procedure to permanently delete a content category list from your organization.

  • Added: Use the following procedure to permanently delete a content category list from your organization.

Troubleshoot Private Access Rules

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/private-access-rules-intro/troubleshoot_private_access_rules.html

  • Added: Use Events to investigate browser-based ZTA connections.

Manage IPS Profiles

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/ips-profiles-intro/manage_ips_profiles.html

  • Removed: Click Add and enter a name for your custom signature list and choose either Detection or Prevention for Intrusion System Mode.

  • Added: Click + IPS Profile and enter a name for your custom signature list and choose either Detection or Prevention for Intrusion System Mode.

Manage Client-Based Zero Trust Access in Secure Access

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/zero-trust-access-intro/manage-client-based-zta-overview.html

  • Removed: Note: While you can sustain multiple site environments note that having duplicate destinations assocaited with a resource connector may affect mobile functionality with Secure Private Access.

  • Added: Note: While you can sustain multiple site environments note that having duplicate destinations associated with a resource connector may affect mobile functionality with Secure Private Access.

  • Removed: Block HTTPS Pages with Zero Trust Access

  • Added: Block Experience with ZTA

  • Added: Default Block Action

  • Added: ZTA blocks traffic through a combination of traffic steering, rules attributed to the access policy, and enforcement modes.

  • Added: Where traffic steering and interception determines if ZTA should handle a traffic request before the request is authorized, either by a destination match or exclusion configured as part of your traffic steering, the access policy evaluates if traffic should be permitted post-interception based on explicit rules, matching criteria in rules, or specific rule order.

  • Added: Intercepted traffic that doesn't explicitly match any custom access policy rules is default blocked by the system policy.

  • Added: This specific case triggers a ZTA remediation flow to evaluate and identify the reason for denied access.

  • Added: If this occurs for multiple requests simultaneously, the system can experience overwhelming load due to the expensive nature of the remediation flow.

  • Added: In such a scenario, remediation is throttled at an organization level during this increased window and a generic Access was blocked by the default rule block reason is reported in the Activity Search logs.

  • Added: Block Enforcement Pages

  • Removed: 5 minutes

  • Added: 1 minute

  • Added: General policy and posture based blocks

  • Added: 30 seconds

  • Added: Process

  • Removed: MDM Enrollment

  • Added: Certificate Enrollment

  • Added: Android

  • Added: ChromeOS

  • Added: For more information about MDM enrollment and recommended configuration guidelines, see Configure iOS Settings in Mobile Device Manager (MDM)and Configure Android Settings in MDM respectively.

  • Added: Traffic Steering: Secure Internet Access for all internet destinations

  • Added: iOS

  • Added: Android

  • Added: ChromeOS

  • Added: iOS 26.5

  • Added: Note: Trusted server probes do not support certificate hash checks; only the first probe URL is used.

  • Added: Trusted Network Detection (Secure Internet Access and Secure Private Access)

  • Added: iOS

  • Added: Android

  • Added: ChromeOS

  • Added: All versions.

  • Added: Note iOS does not support virtual interface detection, and multiple interface evaluation matches network fingerprint rules against a single OS-preferred adapter.

  • Added: Pause ZTA with Cisco Secure Client

  • Added: Android

  • Added: ChromeOS

  • Added: All versions.

  • Added: Note: For information on known issues in Client compatibility see the Secure Client Release Notes.

Manage Zero Trust Access Posture Profiles

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/zero-trust-access-intro/manage_zero_trust_access_posture_profiles.html

  • Removed: Module name—The name of the posture profile integration for broswer used.

  • Added: Module name—The name of the posture profile integration for browser used.

Manage Endpoint Security

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/endpoint-security-intro/manage_endpoint_security.html

  • Added: Note Edge for Business Posture enforcement checks are only applicable for clients connecting from clients running Windows OS due to restrictions by the MS Edge for Business Connector.

Deploy VAs in Hyper-V for Windows 2012 or Higher

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/virtual-appliances-intro/deploy_vas_in_hyper-v_for_windows_2012_or_higher.html

  • Removed: The two files, dynamic and forwarder-va. must be renamed per the VA that is being installed.

  • Added: The two files, dynamic and forwarder-va must be renamed per the VA that is being installed.

Deploy VAs in KVM

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/virtual-appliances-intro/deploy_vas_in_kvm.html

  • Removed: To successfully deploy a virtual appliance in a KVM envinronment, follow the steps as they are listed below:

  • Added: To successfully deploy a virtual appliance in a KVM environment, follow the steps as they are listed below:

Deploy VAs in Alibaba Cloud

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/virtual-appliances-intro/deploy_vas_in_alibaba_cloud.html

  • Removed: Note You must deploy at least two Virtual Appliances (VAs) in a Secure Access Site.

  • Added: Note: You must deploy at least two Virtual Appliances (VAs) in a Secure Access Site.

  • Added: A VA running version 3.6.1 or above.

Manage Notification Pages

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/notification-pages-intro/manage_notification_pages.html

  • Removed: Note: You can allow users to directly contact their administrators by enabling Allow blocked users to contact an adminstrator.

  • Added: Note: You can allow users to directly contact their administrators by enabling Allow blocked users to contact an administrator.

Manage the Data Loss Prevention Policy

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/data-loss-prevention-intro/manage-data-protection-policies.html

  • Removed: text/plain

  • Added: text/plain**

  • Removed: text/plain

  • Added: text/plain**

  • Added: ** Plain text files, such as plain text.txt and UNIX_SCRIPT, as well as JSON files, are not supported when the file type is used as the only matching criterion.

  • Added: They are supported only when combined with other matching criteria.

Add a SaaS API Rule to the Data Loss Prevention Policy

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/data-loss-prevention-intro/add-a-saas-api-rule.html

  • Removed: For the next step in the process, see Create a DLP SaaS API Rule Step 3 — Select Files Controls

  • Added: For the next step in the process, see Create a DLP SaaS API Rule Step 3 — Select Platform and Tenant

  • Removed: Create a DLP SaaS API Rule Step 3 — Select Files Controls

  • Removed: This is the third step in the process to add a SaaS API rule to a DLP policy, in which you select the files controls to apply to the rule.

  • Added: Create a DLP SaaS API Rule Step 3 — Select Platform and Tenant

  • Added: This is the third step in the process to add a SaaS API rule to a DLP policy, in which you select one platform and tenant for the rule.

  • Removed: For the next step in the process, see Create a DLP SaaS API Rule Step 4 — Select Platform and Tenant

  • Added: For the next step in the process, see Create a DLP SaaS API Rule Step 4 — Select Files Controls

  • Added: Create a DLP SaaS API Rule Step 4 — Select Files Controls

  • Added: This is the fourth step in the process to add a SaaS API rule to a DLP policy, in which you select the files controls to apply to the rule.

  • Added: For the previous step in the process, see Create a DLP SaaS API Rule Step 3 — Select Platform and Tenant

  • Removed: Create a DLP SaaS API Rule Step 4 — Select Platform and Tenant

  • Removed: This is the fourth step in the process to add a SaaS API rule to a DLP policy, in which you select one platform and tenant for the rule.

  • Removed: For the previous step in the process, see Create a DLP SaaS API Rule Step 3 — Select Files Controls

  • Removed: For the previous step in the process, see Create a DLP SaaS API Rule Step 4 — Select Platform and Tenant

  • Added: For the previous step in the process, see Create a DLP SaaS API Rule Step 4 — Select Files Controls

Add an AI Guardrails Rule to the Data Loss Prevention Policy

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/data-loss-prevention-intro/add_an_ai_guardrails_rule_to_the_data_loss_prevention_policy.html

  • Removed: For each application you can scan one of three traffic options: Prompt (from your system to the AI application), Response (from the AI application to your system), or Prompt & Response.

  • Added: For each application (except Microsoft Copilot), you can scan one of three traffic options: Prompt (from your system to the AI application), Response (from the AI application to your system), or Prompt & Response.

  • Added: Tip: At this time, Microsoft Copilot is only supported in the Prompt direction.

Discovery Scan

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/data-loss-prevention-intro/discovery_scan.html

  • Removed: Note that the cancelation of a scan might take a few minutes.

  • Added: Note that the cancellation of a scan might take a few minutes.

SaaS API Data Loss Prevention

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/saas-api-data-loss-prevention-intro.html

  • Added: Enable SaaS API Data Loss Prevention for GitHub Tenants

  • Added: Explains how SaaS API Data Loss Prevention (DLP) policies are applied to GitHub tenants to identify and protect sensitive data by scanning various content types.

Cloud Malware Protection

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/cloud-malware-protection-intro.html

  • Removed: Enable Cloud Malware Protection

  • Removed: Provides instructions for completing the Enable Cloud Malware Protection workflow in Cisco Secure Access.

  • Removed: It explains the sequence of actions and relevant settings presented in the procedure.

  • Removed: Revoke Authorization for a Platform

  • Removed: Provides instructions for completing the Revoke Authorization for a Platform workflow in Cisco Secure Access.

  • Removed: It explains the sequence of actions and relevant settings presented in the procedure.

  • Added: Enable Cloud Malware Protection for GitHub Tenants

  • Added: Configure cloud malware protection for GitHub to monitor repository files for security threats and ensure compliance.

  • Removed: Enable Cloud Access Security Broker Protection for Microsoft 365 Tenants

  • Removed: Describes Enable Cloud Access Security Broker Protection for Microsoft 365 Tenants in Cisco Secure Access and explains Limitations.

  • Removed: It summarizes the behavior, configuration context, and operational considerations presented throughout the topic.

Manage Cloud Malware Protection

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/cloud-malware-protection-intro/manage_cloud_malware_protection.html

  • Removed: The system will remove all collaborators and change the file owner to the Salesforce admin who has performed the authorization, and who has been assigned the permisson set for the quarantine app.

  • Added: The system will remove all collaborators and change the file owner to the Salesforce admin who has performed the authorization, and who has been assigned the permission set for the quarantine app.

  • Added: Enable Cloud Malware Protection

  • Added: Enable Cloud Malware Protection so that Secure Access scans your environment's cloud platforms for malicious files and any other risks.

  • Added: When Cloud Malware Protection finds malicious files, the information is presented in the Cloud Malware Report.

  • Added: Before you begin

  • Added: Full Admin user role.

  • Added: For more information, see Manage Accounts.

  • Added: Procedure

  • Added: Navigate to Admin> Authentication.

  • Added: In the Platforms section, expand a platform.

  • Added: Click Authorize New Instance to add an instance of this platform to your Secure Access environment.

  • Added: You can authorize more than one instance of the same platform.

  • Added: What to do next

  • Added: Secure Access redirects you to the platform's OAuth login page.

  • Added: Follow the instructions for the platform that you selected to authorize access to Secure Access:

  • Added: AWS S3

  • Added: Azure Storage

  • Added: Box

  • Added: Confluence

  • Added: Dropbox

  • Added: Google

  • Added: Jira

  • Added: Microsoft 365

  • Added: Salesforce

  • Added: ServiceNow

  • Added: Slack

  • Added: Webex Teams

  • Added: Revoke Authorization for a Platform

  • Added: After authorizing a platform in your Secure Access environment, you can revoke authorization at any time.

  • Added: Before you begin

  • Added: Full Admin user role.

  • Added: For more information, see Manage Accounts.

  • Added: Procedure

  • Added: Navigate to Admin> Authentication.

  • Added: Under Platforms, click the platform that you wish to revoke.

  • Added: Choose the instance to revoke and click Revoke.

  • Added: Click Revoke again to complete the process.

Enable Cloud Access Security Broker Features for Google Drive

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/cloud-malware-protection-intro/enable_cloud_access_security_broker_features_for_google_drive.html

  • Added: Enable Cloud Access Security Broker Protection for Microsoft 365 Tenants

  • Added: Secure Access supports two Cloud Access Security Broker (CASB) features for Microsoft 365:

  • Added: Cloud Malware protection for OneDrive, SharePoint Online, and Outlook sites within your Microsoft 365 deployment.

  • Added: Note on running both Microsoft 365 and Cloud Malware: Microsoft 365 and Cloud Malware both protect users against malware.

  • Added: However, their functionalities are not redundant.

  • Added: Microsoft 365 might discover malware that Cloud Malware does not find.

  • Added: Cloud Malware also finds malware that Microsoft 365 overlooks.

  • Added: There is value to running Microsoft 365 and Cloud Malware simultaneously.

  • Added: CASB detection of third-party cloud applications that have been granted OAuth-based permission to access a user's protected resources on Microsoft 365 Sharepoint Online and OneDrive.

  • Added: For more information, see Third-Party Apps Report.

  • Added: You can enable CASB features for authorized tenants that use the following Microsoft 365 applications:

  • Added: Sharepoint Online

  • Added: OneDrive

  • Added: Outlook (For Cloud Malware protection only and for the primary inbox only.

  • Added: For outgoing mail you can enable Data Loss Prevention; see Enable SaaS API Data Loss Prevention for Microsoft 365 Tenants.)

  • Added: Note You cannot add an application to an existing tenant.

  • Added: If you have an existing Microsoft 365 tenant that uses one or two of these applications and you wish to add another application to that tenant, you must first revoke authorization for the existing tenant, then create a new tenant using all the desired applications.

  • Added: Limitations

  • Added: A tenant the fails to authenticate cannot be deleted.

  • Added: Secure Access Cloud Malware attempts to quarantine a file will fail if that file has been locked by Microsoft 365.

  • Added: This may occur if Microsoft 365 Advanced Threat Protection (ATP) has detected malware in the file.

  • Added: In such a case, the lock placed by ATP take precedence over Umbrella's ability to detect or remediate DLP violations in malware.

  • Added: Prerequisites for Enable Cloud Access Security Broker Protection for Microsoft 365 Tenants

  • Added: Full Admin user role.

  • Added: For more information, see Manage Accounts.

  • Added: Chrome or Firefox (recommended) with pop-up blockers and ad blockers disabled (only for the duration of authorization)

  • Added: The user performing the installation must use a service account with a Microsoft 365 Global Admin and active license

  • Added: Audit log must be enabled for Microsoft 365.

  • Added: For more information, refer to Microsoft Technical documentation and search for Turn auditing on or off.

  • Added: Sharepoint Online and OneDrive must be enabled for the organization.

  • Added: The following IP addresses must be allowed if there are Firewall rules that prevent third-party applications:

  • Added: 146.112.161.0/24

  • Added: 146.112.163.0/24

  • Added: 146.112.165.0/24

  • Added: 146.112.167.0/24

  • Added: Users must have the following API permissions for Microsoft:

  • Added: API/ Permissions Name

  • Added: Type

  • Added: Description

  • Added: Admin Consent Required

  • Added: Microsoft Graph

  • Added: 1.

  • Added: Directory.AccessAsUser.All

  • Added: Delegated

  • Added: Access directory as the signed-in user

  • Added: Yes

  • Added: 2.

  • Added: Directory.Read.All

  • Added: Application

  • Added: Read directory data

  • Added: Yes

  • Added: 3.

  • Added: Files.Read.All

  • Added: Delegated

  • Added: Read all files that user can access

  • Added: No

  • Added: 4.

  • Added: Files.Read.All

  • Added: Application

  • Added: Read files in all site collections

  • Added: Yes

  • Added: 5.

  • Added: Sites.Read.All

  • Added: Delegated

  • Added: Read items in all site collections

  • Added: No

  • Added: 6.

  • Added: User.Read

  • Added: Delegated

  • Added: Sign in and read user profile

  • Added: No

  • Added: 7.

  • Added: User.Read.All

  • Added: Application

  • Added: Read all users' full profiles

  • Added: Yes

  • Added: Microsoft 365 Management APIs

  • Added: 1.

  • Added: ActivityFeed.Read

  • Added: Application

  • Added: Read activity data for the Organization

  • Added: Yes

  • Added: SharePoint

  • Added: 1.

  • Added: Site.FullControl.All

  • Added: Application

  • Added: Full control of all site collections

  • Added: Yes

  • Added: 2.

  • Added: User.Read.All

  • Added: Application

  • Added: Read user profiles

  • Added: Yes

  • Added: Authorize a Tenant

  • Added: Procedure

  • Added: Navigate to Admin> Authentication.

  • Added: Click to expand Microsoft 365 in the list of Platforms.

  • Added: Click Authorize New Tenant in the Cloud Access Security Broker subsection to add a Microsoft 365 tenant to your Secure Access environment.

  • Added: Check the boxes to confirm that you meet all three Authentication Requirements in the Microsoft 365 Authorization Prerequisites dialog, then click Next.

  • Added: Create a name for your tenant, then click Next.

  • Added: Select one or both Cloud Access Security Broker (CASB) features to authenticate: Cloud Malware and Third-Party Apps.

  • Added: If you choose to authorize for Cloud Malware protection, you must also select a Response Action for Umbrella to apply to Microsoft 365 files found with malware.

  • Added: Choose Monitor to cause Umbrella to log files detected with malware.

  • Added: You will be able to manually quarantine these files from the Cloud Malware report.

  • Added: Choose Quarantine to:

  • Added: Move the file into a folder named Cisco_Quarantine_Malware in the root path of the admin who authorized the tenant, remove all collaborators, and change the file owner to the Microsoft 365 admin.

  • Added: Replace the file in its original location with a text file named filename.ppt_Cisco_Quarantined.txt explaining to the original file owner that the file is identified as malware and for more information to contact their organization administrator.

  • Added: Note: If you choose Quarantine this will apply only to rules applied to Sharepoint and OneDrive; Secure Access Cloud Malware supports monitoring Outlook messages in the primary inbox, but cannot quarantine them.

  • Added: For more information on Cloud Malware monitoring and quarantine features, see Manage Cloud Malware Protection.

  • Added: For more information on Third-Party Apps detection features, see Third-Party Apps Report.

  • Added: After making your selections, click Next.

  • Added: Define the message to appear in the Tombstone File when files are quarantined.

  • Added: A file with malicious content may be quarantined when first detected during the Cloud Malware scanning process, or the user may choose to manually quarantine a file when reviewing the Cloud Malware Report.

  • Added: In either case, when a file is quarantined Secure Access creates a tombstone file as described in the previous step.

  • Added: You determine the contents of this tombstone file:

  • Added: To Use the Default Tombstone Template:

  • Added: Click Default.

  • Added: To preview the content of the tombstone text, click on Preview Default Tombstone.

  • Added: You can review the text, but you cannot change it.

  • Added: Click CLOSE to close the preview.

  • Added: To Use a Custom Tombstone Template:

  • Added: Click Custom.

  • Added: From the drop-down list, select an existing custom template, or choose Create new tombstone Template.

  • Added: If you select an existing custom template, you can click PREVIEW AND EDIT to review and change the template.

  • Added: When you choose to create or edit a custom template for for tombstone text you will see one of these two dialogs, which are almost identical:

  • Added: The Edit Custom Tombstone Template includes a DELETE link which you can use to delete a custom template that is no longer needed.

  • Added: You cannot delete a template that is in use by any rule.

  • Added: To create a new template or change an existing template:

  • Added: Enter a unique Custom Template Name.

  • Added: Enter the text of the tombstone file in the Message Body text box.

  • Added: The text can include the following variables, which you must enclose in braces ({}):

  • Added: {eventId} - The unique identifier the system generates for the policy violation event.

  • Added: {detectedTimestamp} - The date and time the violation was detected, formatted as shown in this example: "Oct 1, 2023 at 14:04 UTC"

  • Added: {actorName} - Name of the user whose action triggered the violation.

  • Added: (The system gets this from the tenant associated with the violation.

  • Added: Depending on application and file settings, this information may not be available, in which case the the system replaces this variable with blank text.)

  • Added: {actorEmail} - Email address of the user whose action triggered the violation.

  • Added: (The system gets this from the tenant associated with the violation.

  • Added: Depending on application and file settings, this information may not be available, in which case the system replaces this variable with blank text.)

  • Added: {fileName} - Name of the data file that triggered the violation.

  • Added: {ruleName} - Name of the rule that was triggered.

  • Added: {matchedClassifications} - The data classifications associated with the violation.

  • Added: (See Manage Data Classifications.)

  • Added: {fileOwnerName} - Name of the file owner.

  • Added: (The system gets this from the tenant associated with the violation.

  • Added: Depending on application and file settings, this information may not be available, in which case the the system replaces this variable with blank text.)

  • Added: {fileOwnerEmail} - Email address of the file owner.

  • Added: (The system gets this from the tenant associated with the violation.

  • Added: Depending on application and file settings, this information may not be available, in which case the the system replaces this variable with blank text.)

  • Added: {fileLocation} - The file URL.

  • Added: Note The system replaces a variable with blank text if there is no value assigned to the variable or if an invalid variable name appears within the braces.

  • Added: Click SAVE to complete the changes.

  • Added: Click Next to procede to Integration.

  • Added: At the Integration step, click Next.

  • Added: You are redirected to the Microsoft 365 login page.

  • Added: Log into Microsoft 365 with admin credentials to authorize your Microsoft 365 account as a Secure Access CASB.

  • Added: You are redirected to Secure Access, which displays a message when the authorization is complete.

  • Added: It can take up to 24 hours for the CASB integration status in Secure Access to show that authorization is complete.

  • Added: Click Done to complete.

  • Added: Edit a Tenant

  • Added: You can change the protection type or Response Action you have selected for a tenant.

  • Added: Procedure

  • Added: Navigate to Admin> Authentication.

  • Added: Click to expand Microsoft 365 in the list of Platforms.

  • Added: In the Cloud Access Security Broker subsection, from the Edit column, click Edit.

  • Added: You can edit any tenant.

  • Added: Choose to authorize your Microsoft 365 tenant for Cloud Malware protection, or detection of third-party cloud applications, or both.

  • Added: If you choose to authorize for Cloud Malware protection, you must also select a Response Action for Umbrella to apply to Microsoft 365 files found with malware.

  • Added: Choose Monitor to cause Umbrella to log files detected with malware.

  • Added: You will be able to manually quarantine these files from the Cloud Malware report.

  • Added: Choose Quarantine to:

  • Added: Move the file into a folder named Cisco_Quarantine_Malware in the root path of the admin who authorized the tenant, remove all collaborators, and change the file owner to the Microsoft 365 admin.

  • Added: Replace the file in its original location with a text file named filename.ppt_Cisco_Quarantined.txt explaining to the original file owner that the file is identified as malware and for more information to contact their organization administrator.

  • Added: Note If you choose Quarantine this will apply only to rules applied to Sharepoint and OneDrive; Secure Access supports monitoring outgoing Outlook messages, but cannot quarantine them.

  • Added: For more information on Cloud Malware monitoring and quarantine features, see Manage Cloud Malware Protection.

  • Added: For more information on Third-Party Apps detection features, see Third-Party Apps Report.

  • Added: Change the message to appear in the Tombstone File when files are quarantined.

  • Added: A file with malicious content may be quarantined when first detected during the Cloud Malware scanning process, or the user may choose to manually quarantine a file when reviewing the Cloud Malware Report.

  • Added: In either case, when a file is quarantined Secure Access creates a tombstone file as described in the previous step.

  • Added: You determine the contents of this tombstone file:

  • Added: To Use the Default Tombstone Template:

  • Added: Click Default.

  • Added: To preview the content of the tombstone text, click on Preview Default Tombstone.

  • Added: You can review the text, but you cannot change it.

  • Added: Click CLOSE to close the preview.

  • Added: To Use a Custom Tombstone Template:

  • Added: Click Custom.

  • Added: From the drop-down list, select an existing custom template, or choose Create new tombstone Template.

  • Added: If you select an existing custom template, you can click PREVIEW AND EDIT to review and change the template.

  • Added: When you choose to create or edit a custom template for tombstone text you will see one of these two dialogs, which are almost identical:

  • Added: The Edit Custom Tombstone Template includes a DELETE link which you can use to delete a custom template that is no longer needed.

  • Added: You cannot delete a template that is in use by any rule.

  • Added: To create a new template or change an existing template:

  • Added: Enter a unique Custom Template Name.

  • Added: Enter the text of the tombstone file in the Message Body text box.

  • Added: The text can include the following variables, which you must enclose in braces ({}):

  • Added: {eventId} - The unique identifier the system generates for the policy violation event.

  • Added: {detectedTimestamp} - The date and time the violation was detected, formatted as shown in this example: "Oct 1, 2023 at 14:04 UTC"

  • Added: {actorName} - Name of the user whose action triggered the violation.

  • Added: (The system gets this from the tenant associated with the violation.

  • Added: Depending on application and file settings, this information may not be available, in which case the the system replaces this variable with blank text.)

  • Added: {actorEmail} - Email address of the user whose action triggered the violation.

  • Added: (The system gets this from the tenant associated with the violation.

  • Added: Depending on application and file settings, this information may not be available, in which case the system replaces this variable with blank text.)

  • Added: {fileName} - Name of the data file that triggered the violation.

  • Added: {ruleName} - Name of the rule that was triggered.

  • Added: {matchedClassifications} - The data classifications associated with the violation.

  • Added: (See Manage Data Classifications.)

  • Added: {fileOwnerName} - Name of the file owner.

  • Added: (The system gets this from the tenant associated with the violation.

  • Added: Depending on application and file settings, this information may not be available, in which case the the system replaces this variable with blank text.)

  • Added: {fileOwnerEmail} - Email address of the file owner.

  • Added: (The system gets this from the tenant associated with the violation.

  • Added: Depending on application and file settings, this information may not be available, in which case the the system replaces this variable with blank text.)

  • Added: {fileLocation} - The file URL.

  • Added: Note The system replaces a variable with blank text if there is no value assigned to the variable or if an invalid variable name appears within the braces.

  • Added: Click SAVE to complete the changes.

  • Added: Click Next to procede to Integration.

  • Added: At the Integration step, click Next.

  • Added: The new Response Action is displayed.

  • Added: Note For tenants authorized only for CASB detection of third-party applications, no Response Action is shown.

  • Added: Revoke Authorization

  • Added: Procedure

  • Added: Under Action, click Revoke.

  • Added: You can revoke any authorized tenant.

  • Added: Confirm to proceed.

  • Added: The selected account is not authorized.

Manage Internet Security

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/internet-security-intro/manage_internet_security.html

  • Added: Internet Security Bypass Limits

  • Added: When configuring domains and IP addresses in the Internet Security Bypass list, adhere to the following organization capacity limits:

  • Added: List Type

  • Added: Standard Limit (Default)

  • Added: Extended Limit (On Request)

  • Added: Internal and External Domains (Combined)

  • Added: 5,000

  • Added: 9,000

  • Added: IP Addresses

  • Added: 5,000

  • Added: 9,000

  • Added: Internal domains and external domains share a single combined limit per organization.

  • Added: By default, you can configure up to 5,000 total domains.

  • Added: If your organization requires additional capacity (up to 9,000 domains), contact your Cisco representative or Cisco Support to request an increase.

  • Added: Caution: While organizations with extended limits can configure up to 9,000 domain entries, deploying very large bypass lists to roaming devices running Cisco Secure Client increases local memory usage and configuration payload size.

  • Added: For optimal client performance and stability, keep active domain entries consolidated.

  • Removed: Third Party VPN compatibility

  • Added: Third Party VPN Compatibility

  • Removed: This setting requires that you have the Trusted Network Detection (TND) setting enabled in the AnyConnect virutal private network (VPN) profile for the user devices.

  • Added: This setting requires that you have the Trusted Network Detection (TND) setting enabled in the AnyConnect virtual private network (VPN) profile for the user devices.

Manage CA Certificates for VPN Connections and Zero Trust Access Enrollment

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/certificates-intro/manage_ca_certificates_for_vpn_connections_and_zero_trust_access_enrollment.html

  • Removed: The location where you can check the revocation of the certifcate.

  • Added: The location where you can check the revocation of the certificate.

Set up the Zero Trust Access App for iOS Devices

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/client-based-zta-mobile-intro/set_up_the_zero_trust_access_app_for_ios_devices.html

  • Removed: Configure iOS Settings in MDM

  • Removed: We strongly recommend configuring the following settings in your Mobile Device Manager (MDM) to support the full range of functionality and features that Secure Access has to offer.

  • Removed: For information on how to implement these changes in your particular MDM, consult your MDM documentation.

  • Added: Configure iOS Settings in Mobile Device Manager (MDM)

  • Added: At this time, Apple iOS 5.1.19 supports certificate-based zero touch enrollment through the ManagedApp tool.

  • Added: Administrators can use a compatible EMM solution with Declarative Device Management (DDM) support for managed applications to provision the enrollment choice configuration and enrollment certificate identity to ZTA.

  • Added: For more information specifically on Apple managed apps, search for "Apple’s guidance for configuring managed apps".

  • Added: Use the following configurations for certificate-based zero touch enrollment:

  • Added: The device runs iOS 18.4 or later, which supports the ManagedApp configuration and credential delivery used by this feature.

  • Added: ZTA 5.1.19 or later is deployed as a managed app.

  • Added: The EMM solution supports Apple’s DDM managed application configuration and credential provisioning.

  • Added: General DDM support alone does not establish support for these capabilities.

  • Added: A valid ZTA enrollment choice file is configured for certificate-based enrollment, and a certificate identity matching its certificate selection requirements is available.

  • Added: Using the EMM solution, provision the certificate identity and enrollment choice configuration to the managed ZTA app.

  • Added: A certificate identity includes the certificate and its associated private key.

Download the OrgInfo.json File

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/secure-client-windows-mac-linux-intro/procedure_1753019861337_6546.html

  • Removed: Copy your OrgInfo.json file to either the location of the Cisco Secure Client install directory or the Profiles\\secureaccess directory on the local system.

  • Removed: When you deploy the OrgInfo.json file for the first time, the Cisco Secure Client copies the OrgInfo.json file to the data subdirectory (/secureaccess/data), which also contains several registration files.

  • Added: Copy your OrgInfo.json file to either the location of the Cisco Secure Client install directory or the Profiles\\umbrella directory on the local system.

  • Added: When you deploy the OrgInfo.json file for the first time, the Cisco Secure Client copies the OrgInfo.json file to the data subdirectory (/umbrella/data), which also contains several registration files.

  • Removed: %ProgramData%\\Cisco\\Cisco Secure Client\\SecureAccess

  • Added: %ProgramData%\\Cisco\\Cisco Secure Client\\Umbrella

  • Removed: Alternatively, before installing the Cisco Secure Client, copy the OrgInfo.json file to \\Profiles\\secureaccess.

  • Removed: The Secure Access module installer is located in \\Profiles\\secureacces.

  • Added: Alternatively, before installing the Cisco Secure Client, copy the OrgInfo.json file to \\Profiles\\Umbrella.

  • Added: The Secure Access module installer is located in \\Profiles\\Umbrella.

  • Removed: /opt/cisco/secureclient/secureaccess/

  • Added: /opt/cisco/secureclient/umbrella/

Manage Internet Security on Cisco Secure Client

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/internet-security-secure-client-intro/manage-cisco-secure-client-internet-security.html

  • Added: Internet Security Bypass Sizing: Cisco Secure Access supports up to 5,000 combined domain entries (and up to 9,000 entries upon request to your Cisco representative or Cisco Support).

  • Added: While large lists are supported, maintaining consolidated domain lists is recommended for optimal performance and reduced memory utilization on roaming devices running Cisco Secure Client.

  • Added: For more information, see Manage Internet Security Bypass.

  • Added: The Umbrella Roaming Security Module for Cisco Secure Client is not supported on Windows Server.

  • Removed: The Cisco Secure Client Umbrella Roaming Security module is not compatible with other DNS serving software.

  • Removed: You should not install the Cisco Secure Client Umbrella module on a device that serves DNS requests.

  • Added: The Umbrella Roaming Security Module for Cisco Secure Client is not supported on Windows Server and is incompatible with other DNS-serving software.

  • Added: Do not install the module on a device that serves DNS requests.

  • Added: The module’s dnscryptproxy subprocess encrypts DNS traffic and listens on UDP and TCP port 53.

  • Added: This port usage conflicts with the Windows DNS Server service.

  • Added: The module is also generally incompatible with other software that binds to UDP or TCP port 53 on localhost, regardless of the operating system.

Manage Logging

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/logging-intro/manage_logging.html

  • Added: A custom certificate is required only for logging Web DLP violation evidence to your own Amazon S3 bucket.

  • Added: Endpoint DLP, Email DLP, and SaaS API DLP violation events continue to be logged to your S3 bucket without a custom certificate.

  • Added: Web DLP violation evidence logging is not supported for organizations using a shared certificate (Secure Access Root Cert), due to potential security vulnerabilities.

  • Added: Endpoint DLP, Email DLP, and SaaS API DLP violation events continue to be logged to your S3 bucket.

Log Formats and Versioning

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/logging-intro/log_formats_and_versioning.html

  • Removed: Note: The Event Correlation ID is not used in ZTNA, as its functionality is covered by the Transaction ID field.

  • Added: For a browser-based connection, the authorization, establishment, and termination records share the same Transaction ID.

  • Added: In Events, use the Event ID to display these records.

  • Added: Note

  • Added: The Event Correlation ID is not used in ZTNA, as its functionality is covered by the Transaction ID field.

  • Added: Note:

  • Removed: ZTA flow logs show traffic events in client-based and browser-based ZTA sessions that take place after successful authentication.

  • Added: ZTA flow logs show traffic after successful authentication for clientbased and browserbased sessions.

  • Added: For browserbased access, each TCP connection has establishment and termination records.

  • Added: Match Transaction IDs to correlate these records with authorization logs.

  • Added: One application session can use several connections.

  • Added: Use log format version 10 or later.

  • Removed: "2025-10-02 23:52:53","network@example.com","network@example.com, Network.

  • Removed: AD Computer","Networks","ts-auto.com","1234567","1254367","Gd2o4Dr9PBERUpCvvAneaKbBqA6Di4Io","45937","45873","147","56","TERMINATED","App did not respond","CLAP","129","CONN_FAILURE","453","7756","1.1.1.1","3000","256","4001","FTD","12321321312","","

  • Added: "2026-08-28 12:34:56","alice@example.com","alice@example.com","managed-device-123","AD Users","Managed Devices","100001","","ztna-host","txn-abc-123","999","888","777","666","555","444","TERMINATED","Timeout","CLAP","CONN_FAILURE","1024","2048","100","443","333","8080","Enforcement Point","ftd-123","FTD Device"

  • Added: For browser-based flow records, the timestamp identifies establishment or termination according to Connection Status.

  • Added: Termination is not necessarily application logout.

  • Added: For browser-based ZTA, Connected marks establishment; Terminated marks closure.

  • Added: For browserbased ZTA, final totals are available at termination.

  • Added: For browser-based ZTA, final totals are available at termination.

  • Removed: However, it can be found in the ZTA logs using the same transaction ID..

  • Added: However, it can be found in the ZTA logs using the same transaction ID.

  • Added: source ip

  • Added: The source IP address of the client endpoint for the Zero Trust Access flow.

  • Added: v18

  • Added: destination ip

  • Added: The destination IP address for the flow.

  • Added: v18

  • Added: application protocol

  • Added: The application layer protocol used by the flow.

  • Added: Example: HTTPS.

  • Added: v18

Security Activity Report

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/activity-reports-intro/security-activity-report.html

  • Added: The Security Activity report shows security activity over time and matching events in a table.

  • Added: Use Search Security Activity, Event type, Response, and Filters above the chart to refine the results.

Events Report

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/events-report-intro/events-report-overview.html

  • Removed: Status: Action taken (Allowed, Blocked, or Isolated).

  • Added: Status: Action taken (Allowed, Blocked, Isolated, Connected, or Disconnected).

  • Added: Browser-based authorization records are ZTA Clientless; TCP connection records are ZTA Clientless Flow.

  • Added: Browser-based flows can have statuses such as Connected or Disconnected.

  • Added: For browser-based events, select ZTA Clientless.

  • Added: View Browser-based ZTA Flow Events

  • Added: Use the Events report to investigate browser-based Zero Trust Access (ZTA) connections to a private resource.

  • Added: Authorization records show the access decision.

  • Added: Flow records show when an underlying TCP connection is established and terminated.

  • Added: Related records share an Event ID.

  • Added: An application session can use several TCP connections.

  • Added: Each connection has its own lifecycle records.

  • Added: Connection timestamps do not necessarily identify the times that a user signs in to or signs out of an application.

  • Added: Procedure

  • Added: Choose Monitor> Reports> Events.

  • Added: Choose the time range to investigate, for example, Last 30 minutes.

  • Added: Select ZTA Clientless.

  • Added: To narrow the results, filter by the destination private resource.

  • Added: Authorization records appear as ZTA Clientless.

  • Added: Connection lifecycle records appear as ZTA Clientless Flow.

  • Added: Click the arrow next to an event to open the Event Details card.

  • Added: Review the available source, connection, security control, and destination information.

  • Added: Click the Event ID value and choose Search.

  • Added: Remove unrelated filters if they exclude records that you need for the investigation.

  • Added: The report displays the authorization record and the related Connected and Disconnected flow records for that connection.

  • Added: Compare the Time values on the matching Connected and Disconnected rows to determine when the connection was active.

  • Added: Use the event row timestamps for this comparison.

  • Added: The Session end time field in the detail card can be blank.

  • Added: If a matching Disconnected record has not appeared, the connection might still be open.

  • Added: Connected records remain in the report after their corresponding Disconnected records appear.

  • Added: Note: Connections can overlap.

  • Added: Do not add connection durations together to calculate the duration of an application session.

  • Added: Expand the Disconnected flow record.

  • Added: Under Security Controls> ZTA clientless flow, review Session Bytes Received and Session Bytes Sent.\

  • Added: Final byte totals are available when the connection disconnects.

  • Added: They are not available in its Connected record.

  • Added: Review Reason Code in the event table or Reason in the Connection card for available closure information.

  • Added: A normal closure can populate these fields.

  • Added: A populated reason does not necessarily indicate a failed connection.

  • Added: For example, an RDP End session action can be followed by close_event=local_close and local_close_reason=triggered_delayed_close_timeout.

  • Added: Other browser connections can remain open while the application page is loaded.

  • Added: Closing the browser tab can close those connections and produce close_event=remote_close.

Microsoft Edge for Business Third-Party Integration

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/secure-access-integrations-intro/ms_edge_for_business_third_party_integration.html

  • Removed: In your Secure Access organization, view the third-party integrations configured for Microsft Edge for Business.

  • Added: In your Secure Access organization, view the third-party integrations configured for Microsoft Edge for Business.

  • Removed: Name—The name of the Third-party Integration for Microsft Edge for Business.

  • Added: Name—The name of the Third-party Integration for Microsoft Edge for Business.

  • Removed: Module name—The name of the Third-party Integration for Microsft Edge for Business.

  • Added: Module name—The name of the Third-party Integration for Microsoft Edge for Business.

  • Removed: Organizations can edit a Third-party Integration for Microsft Edge for Business in Secure Access.

  • Added: Organizations can edit a Third-party Integration for Microsoft Edge for Business in Secure Access.

Integrate ISE (Identity Services Engine) with Secure Access

https://www.cisco.com/c/en/us/td/docs/security/secure-access/secure-access-help/CiscoSecureAccessHelp/secure-access-integrations-intro/integrate-ise.html

  • Removed: We strongly recommend modifying or creating a private access rule to further incorprate this successful integration.

  • Removed: You can now include private IP addresss from the security group tag (SGT) originating from the ISE appliction as either the source or the destination.

  • Added: We strongly recommend modifying or creating a private access rule to further incorporate this successful integration.

  • Added: You can now include private IP address from the security group tag (SGT) originating from the ISE application as either the source or the destination.

Added Pages

Removed Pages

No pages were removed.