Cisco Secure Access Help

PDF

Cisco Secure Access Help

Mass Deployment Overview

Updated: August 24, 2026

Want to summarize with AI?

Log in

Describes Mass Deployment Overview in Cisco Secure Access. Cisco Secure Client can be deployed with endpoint management software designed to remotely install applications.

Remote Installation

Cisco Secure Client can be deployed with endpoint management software designed to remotely install applications. This includes tools such as Unified Endpoint Management (UEM) and Remote Management and Monitoring (RMM).

The remote installation options outlined below includes installing both the Cisco Secure Client software and the Umbrella profile (OrgInfo.json), similar to the steps followed in the manual deployment process.

Scripted Installation
  • Cisco Secure Client is installed by endpoint management software.
  • The Umbrella profile information is copied to the endpoint by a post install script or task.
Mass Deployment Package
  • The installation package or source is modified, and the Umbrella configuration profile is bundled with this package or source prior to installation.
  • The customized package can be installed by endpoint management software with the profile that is already included.
VPN Headend Deployment (This option is suitable for customers using Secure Client for VPN.)
  • The software and profile are uploaded to the VPN headend.
  • Umbrella is automatically downloaded and installed when the corresponding user connects to the VPN.
RMM Deployment

(This option is suitable for managed service providers.)

Cisco Secure Client can be deployed to multiple end customers using RMM tools.

Profile Installation

Installing your Umbrella organization profile (OrgInfo.json) is a mandatory step in the deployment process because this file uniquely identifies your Umbrella organization and is required for the Cisco Secure Client to register with Umbrella. The following diagrams show the two main ways in which the Umbrella organization profile can be distributed.

  • Bundle Profile:The profile (OrgInfo.json) is bundled with the installation package prior to installation.
  • Copy Profile : The profile (OrgInfo.json) is copied to a location in the endpoint (programmatically) after installation. (MDM - Managed Device Manager).

Customization Options

Before performing a mass deployment of Cisco Secure Client, you may consider the following common installation customizations.

  1. Select Cisco Secure Client Modules

    Choose which Cisco Secure Client modules you want to install. For a minimum installation (Umbrella protection only) you must install two modules:

    • Core & AnyConnect VPN module

    • Umbrella module

    Choose the modules using the following methods.
    Windows Using a 'Pre-Deployment' package, the modules are provided as individual Microsoft Software Installer (MSIs). Only install the desired .msi files. A minimum of two .msi files must be installed (Core VPN + Umbrella module)
    macOS Using a 'Pre-Deployment' package Cisco Secure Client (and its modules) are installed using a single .dmg image. An 'install_choices.xml' file can be provided to the macOS installer to disable unwanted modules. Alternatively, use a 'Web Deployment' package, install each Cisco Secure Client module using a separate .dmg image. A minimum of two .dmg image files must be installed (Core VPN + Umbrella module)

  2. Disable VPN Functionality

    The Core Secure Client VPN module must be installed for the Umbrella module to function. However, the VPN functionality itself is not required and can be disabled ( for macOS and Windows) such that it is not available to users. Each of the installation methods on this page provide options for disabling Cisco Secure Client VPN.

    You can disable the VPN functionality using one of these methods:

    • During manual installation uncheck the Core & AnyConnect VPN (for Windows and macOS).

    • Disable the VPN functionality within a customized .dmg package (macOS).

    • Disable the VPN functionality by deploying a special VPN profile (Windows and macOS).

    For more information, see Disable the VPN Module in Secure Client.

  3. Lockdown Services (Windows)

    On Windows, you can customize the installation to prevent users from tampering with Cisco Secure Client. To do this, modify any of the msiexec commands and provide these additional MSI parameters:

    • LOCKDOWN=1 : Prevents the service from being stopped.

    • ARPSYSTEMCOMPONENT=1 : Hides the program from Programs and Features in Windows.

    For more information, see Understand Command Line Installation and RMM Reference for Umbrella Module.