Security & Backup

Cisco Umbrella

Run Cisco Umbrella DNS security conversationally - block and allow domains, manage roaming computers and policies, and answer "what was blocked" from the reports.

Dex connects to the Cisco Umbrella API v2 so admins can run DNS security without leaving the conversation - block or allow domains through destination lists, find and manage roaming computers, apply DNS policies to identities, and answer "what was blocked and for whom" from the activity reports. It is an MSP global app: one shared parent (provider) API key and secret covers every Managed customer, and each Dex tenant is confined to its Umbrella customerId - a token minted for that customer's org and verified against orgInfo before use. The MSP master handles the customer roster (list, create, update, delete); each customer's DNS security is managed from that customer's own Dex tenant. Dex Go is off, so this is an admin-only app.

Start free →

What Dex does with Cisco Umbrella

Dex handles both admin workflows and employee self-service — all policy-guardrailed and audit-logged.

For admins (Dex Pro)

Block or allow domains by adding and removing destination-list entries, including the Global Block and Global Allow lists
Create, rename, and delete destination lists, and list their entries
Find and manage roaming computers - search by name or status, read details, rename, and remove a device from Umbrella
List networks and DNS policies, and apply or remove a policy for an identity
Answer "was this blocked and for whom", top destinations, top identities, and 7-day summaries from the activity reports
Look up a domain's Umbrella security status and categories via Investigate (license permitting)
Manage the MSP Managed customer roster from the master connection - list, create, read, update, and delete customers
Deploy as an MSP global app - one shared parent API key and secret, each customer confined to its Umbrella customerId

Just ask Dex

Your team types a request in plain language. Dex investigates, plans, and executes — with the right guardrails.

Admin prompts

>Block example.com on the Global Block List and note it was requested by the admin
>Was example.com blocked in the last day, and for whom?
>Which roaming computers are showing status Off or Disabled?
>Give me the top blocked destinations for the last 7 days
>Rename roaming computer AB00C7DCEC99D211 to "LAPTOP-42 (Jane)"
>List the Managed customers under our provider account

Policy actions

Every action Dex can take on Cisco Umbrella is declared, scoped, and guardrailed. Admins control which apply, who approves them, and whether they're limited to self-service.

Action	What it does	Guardrails
`umbrella_list_customers`	List Managed Umbrella customers (MSP master connection only)	—
`umbrella_create_customer`	Create a Managed Umbrella customer (MSP master only) - seat/billing impacting	approval
`umbrella_read_customer`	Read an Umbrella Managed customer record	—
`umbrella_update_customer`	Update an Umbrella Managed customer name/seats (MSP master only) - seat changes are billing-impacting	approval
`umbrella_delete_customer`	Delete an Umbrella Managed customer (MSP master only) - destructive, disabled by default	approval
`umbrella_list_destination_lists`	List this customer's Umbrella destination lists (block/allow)	—
`umbrella_read_destination_list`	Read one Umbrella destination list	—
`umbrella_create_destination_list`	Create an Umbrella destination list	approval
`umbrella_rename_destination_list`	Rename an Umbrella destination list	approval
`umbrella_delete_destination_list`	Delete an Umbrella destination list - destructive	approval
`umbrella_list_destinations`	List the entries of an Umbrella destination list	—
`umbrella_add_destinations`	Add domains/URLs/IPs to an Umbrella block or allow list	approval
`umbrella_remove_destinations`	Remove entries from an Umbrella block or allow list	approval
`umbrella_list_roaming_computers`	List this customer's Umbrella roaming computers	—
`umbrella_read_roaming_computer`	Read one Umbrella roaming computer	—
`umbrella_read_org_info`	Read the customer's Secure Client OrgInfo deployment values	—
`umbrella_rename_roaming_computer`	Rename an Umbrella roaming computer	approval
`umbrella_delete_roaming_computer`	Remove a roaming computer from Umbrella - it stops being protected	approval
`umbrella_list_networks`	List this customer's Umbrella networks	—
`umbrella_list_policies`	List this customer's Umbrella DNS/web policies	—
`umbrella_assign_policy_identity`	Apply an Umbrella policy to an identity (roaming computer, network)	approval
`umbrella_unassign_policy_identity`	Remove an identity from an Umbrella policy	approval
`umbrella_read_reports`	Read Umbrella activity, top-destination, top-identity and summary reports	—
`umbrella_check_domain_categorization`	Look up a domain's Umbrella security status and categories (Investigate license)	—

How to configure Cisco Umbrella

Onboarding takes minutes. Dex validates your credentials before saving them.

Setup steps

1
In the Umbrella parent console, go to Admin > API Keys (Managed Providers) and create an API key for Dex.
2
Grant the key the scopes Dex needs: admin.customers, policies.destinationLists, policies.destinations, deployments.roamingcomputers, deployments.roamingcomputersOrgInfo (read, required on every tenant), deployments.networks, deployments.policies, reports.granularEvents, reports.aggregations, and optionally investigate.investigate.
3
Copy the API key (client id) and API secret (client secret).
4
On the MSP master connection, leave customer_id blank. For each customer tenant, read the numeric customerId from GET /admin/v2/managed/customers on the master.
5
In Dex, enable the Umbrella integration and paste the api_key and api_secret; set customer_id on each tenant. Dex mints a token for that customer's org and verifies it against orgInfo before saving.

Vendor documentation ↗

Credentials required

api_key: Umbrella API key / OAuth client id from the parent console (secret)
api_secret: Umbrella API secret / OAuth client secret from the same key registration (secret)
customer_id: This tenant's Umbrella customerId as a positive-integer string - leave blank on the MSP master connection (per-customer isolation)

Requirements

•A Cisco Umbrella account with Managed Providers access and a parent API key/secret
•The deployments.roamingcomputersOrgInfo read scope on every tenant - the connection uses it to prove the token is bound to the right customer
•The customer roster and customer create/update/delete are MSP-master work; each customer's DNS security is managed from that customer's own tenant
•Investigate domain categorization requires an Investigate license on the org
•Dex Go is off for this app, so it is admin-only - no employee self-service