Cisco Umbrella part numbers: annual, service provider and MSLA

What you order for Cisco Umbrella

A Cisco Umbrella order has two layers. The top line is the subscription, UMB-SEC-SUB, which sets the start date and term for the customer. Under it sits the package your users are licensed for, counted per covered user:

• DNS Security Essentials (UMB-DNS-ESS-K9): DNS-layer blocking of malware, phishing and other threats, filtering by domain or category, application discovery and roaming protection for DNS traffic
• DNS Security Advantage (UMB-DNS-ADV-K9): everything in Essentials, plus URL-level block and allow lists and proxy inspection of risky traffic (marked partial in Cisco's package comparison) and SIEM and XDR interoperability
• Secure Internet Gateway (SIG) Essentials (UMB-SIG-ESS-K9): adds the full secure web gateway, cloud-delivered firewall for layer 3 and 4 control, cloud access security broker controls, file sandboxing and SD-WAN integration
• Secure Internet Gateway (SIG) Advantage (UMB-SIG-ADV-K9): the higher SIG tier, listed in Cisco's package comparison

Investigate, Cisco's threat intelligence console and API for security teams, is a separate line in three sizes: UMB-INV-API-S, UMB-INV-API-M and UMB-INV-API-L. You order one tier.

For what each package does in practice, and help choosing between them, see Cisco Umbrella licensing (opens in a new tab) and Umbrella Investigate (opens in a new tab) on our Umbrella site. This page is about the part numbers and the routes to buy them.

Umbrella licensing rules that affect the part numbers

Each package code is counted per covered user. Cisco's Umbrella DNS Security offer terms define covered users as the employees, contractors and other individuals whose online or cloud activity Umbrella protects, so the quantity is people, not devices. Order one top-line subscription per customer and one package licence per covered user. Each customer has its own Umbrella organisation (tenant): Cisco's terms do not allow one tenant to be shared between customers.

DNS Security packages also carry a monthly average DNS query allowance of up to 5,000 DNS queries per covered user per day, averaged across the month. If usage runs above it, Cisco can ask for more licences, so it is worth checking query volumes when you set the quantity. SIG bandwidth allowances and education counting rules are set out in Cisco's product terms, and we confirm them, with the term and billing, at quote.

Source: Cisco Umbrella DNS Security offer terms (Secure MSP Center) (opens in a new tab).

Cisco Umbrella part numbers

Umbrella codes from Cisco's own notices. Under EOL15975 they can be ordered until 31 January 2027, and renewed or added to until 31 January 2028 (SPLA-UMB-DNS-A-K9 is not listed in that notice). Order one UMB-SEC-SUB (or UMB-SEC-SP-SUB) per customer, then the package for your covered users and, if you need it, one Investigate tier.

Umbrella annual, MSP and MSLA codes side by side

The same Umbrella package under each buying route, each orderable until 31 January 2027. Investigate is on the annual route in the list above. Cisco lists an MSLA code for DNS Security Advantage only; other MSLA codes are confirmed at quote.

Part numbers from Cisco EOL15975, Umbrella SIG and DNS end of sale and Secure Access migration part numbers (updated 2 September 2026) (opens in a new tab); Cisco EOL15688, legacy Umbrella offers and replacement part numbers (updated 18 June 2025) (opens in a new tab), checked 2026-11-08. Add the licences you need to your basket and request a quote: we confirm the right part numbers, quantities and terms when we quote.

Buying Umbrella monthly: Secure MSP Center and the MSLA

Umbrella can be bought three ways, and the comparison table above puts each package's codes side by side.

• Annual subscription: the price-list codes (UMB-SEC-SUB with a package), with the term and billing confirmed at quote.
• Cisco's MSP programme: Forever Systems supplies Umbrella through Cisco's Secure MSP Center, per user, billed monthly, with terms confirmed at quote. Secure MSP Center lists four Umbrella packages: DNS Essentials, DNS Advantage, SIG Essentials and SIG Advantage. The -SP service-provider codes (UMB-SEC-SP-SUB with UMB-DNS-ESS-K9-SP, UMB-DNS-ADV-K9-SP, UMB-SIG-ESS-K9-SP or UMB-SIG-ADV-K9-SP) are Cisco's published equivalents for providers.
• MSLA (Cisco's Managed Services License Agreement): a monthly, usage-based route. Cisco publishes SPLA-UMB-DNS-A-K9 for DNS Security Advantage; other MSLA codes and terms are confirmed at quote.

Monthly billing suits organisations whose headcount moves, or that want security costs to follow users rather than a fixed annual commitment. An annual term suits a stable user count and a budget set once a year. We can quote both so you can compare. See Secure MSP Center Umbrella packages (opens in a new tab) for Cisco's package comparison and Cisco Umbrella for MSPs (opens in a new tab) for how the multi-org console works.

Umbrella end of sale: the dates that matter

Cisco announced the end of sale of Umbrella SIG and DNS on 1 September 2026 (notice EOL15975), as Umbrella evolves into Cisco Secure Access. The milestones for an order are:

A new subscription needs a start date on or before 31 January 2027, a renewal or change a start date on or before 31 January 2028, and the term of any new or changed subscription has to end by 31 January 2029. Existing Umbrella customers can keep renewing and adding users within those dates, and new deployments are best started on Cisco Secure Access. Our Umbrella site covers the wider Cisco Umbrella end of life (opens in a new tab) timeline.

Source: Cisco EOL15975, end of sale for Umbrella SIG and DNS (opens in a new tab).

Umbrella part numbers and their Secure Access replacements

EOL15975 maps each Umbrella code to a Secure Access code. The annual codes move to the Secure Access price list and the -SP service-provider codes move to Cisco's Provider Pricing:

The notice also covers Umbrella add-ons such as data loss prevention and remote browser isolation, and education codes; we confirm their replacements at quote. Moving to Secure Access is a planned change rather than an automatic upgrade: read Umbrella to Secure Access migration (opens in a new tab) for the steps, or browse other DNS and web filtering products we supply.

Legacy Umbrella part numbers replaced in 2025

Cisco ended sale of its older Umbrella offers on 30 September 2025 (end-of-life notice EOL15688), moving renewals and additions to the UMB-SEC-SUB family, which EOL15975 now takes to end of sale on 31 January 2027. If an old quote or renewal notice shows one of these, this is what replaced it:

Source: Cisco EOL15688, legacy Umbrella offers (opens in a new tab).

How we help

Tell us how many people need protecting, which sites and remote workers are in scope and whether you already have an Umbrella organisation. We can work out the right package and part numbers for a renewal, compare annual and monthly routes, map your codes to Secure Access and place the order. You can add the codes you need to your basket and send them with your enquiry, or simply contact us and we can build the quote with you.