Drupal vs Umbraco: which to choose

When to choose Drupal or Umbraco for an enterprise website

Choose Drupal when your team is comfortable running PHP, your content model is large and heavily structured, and you want a GPL-2.0-or-later platform with no paid edition of Drupal itself. Drupal fits organizations that expect many content types, complex permissions and multilingual publishing, and that are ready to plan for major upgrades on a fixed release schedule. Choose Umbraco when your organization runs on Microsoft technology, your developers work in .NET, and you want an MIT-licensed CMS with a managed hosting option on Umbraco Cloud. Both are credible for enterprise sites, so the decision rarely turns on features alone.

Three questions decide most shortlists. The first is skills: a PHP team and a .NET team will each carry the build, upgrades and incident response for years, so check who you can hire and retain. The second is licensing for add-ons. Umbraco Forms and Umbraco Engage run unrestricted locally but need a valid license on a public domain, and the license terms cover specific domain counts, so price them alongside the CMS. Confirm the current terms with Umbraco before budgeting, since add-on licensing is a separate line from the open-source core. The third is hosting: self-hosting keeps the platform inside your own cloud accounts or data centers, while Umbraco Cloud is a managed service on Microsoft Azure that includes backups, a CDN and Development, Staging and Live environments.

Once the skills and licensing questions are answered, check the support calendar for the exact version you plan to ship. Umbraco 13 reaches end of life on December 14, 2026, while Umbraco 17 is the current LTS release with end of life on November 27, 2028, so a new build should target 17. For Drupal, plan around Drupal 10 end of life on December 9, 2026 and the scheduled Drupal 12.0.0 release. Ask each vendor, and your implementation partner, to confirm these dates against the official pages before you commit.

Which platform fits which enterprise scenario

This table maps common enterprise situations to the platform that usually fits better and the condition that would reverse the choice. Read each row as a starting point, then confirm the licensing, hosting and team questions against your own environment before deciding.

Scenario	Better fit	Why, and when the other platform wins
Existing .NET or Azure estate	Umbraco	Umbraco is built on .NET and requires .NET 10.0 or higher, and Umbraco Cloud runs on Microsoft Azure. Drupal wins if the web estate is already PHP or if content must feed PHP applications.
PHP or Linux-based team	Drupal	Drupal runs on Apache or Nginx with MariaDB, MySQL, PostgreSQL or SQLite and requires PHP 8.3 or later for Drupal 11. Umbraco fits better only if the team can support .NET hosting on Windows or Azure.
Public-domain forms or personalization	Depends on budget and tooling	Umbraco Forms and Umbraco Engage need licenses on public domains, sold per domain. Drupal's core modules carry no paid add-on license, but personalization usually means choosing and maintaining contributed modules. Confirm license cost with Umbraco before comparing totals.
Need to self-host in a private data center	Drupal	Drupal is GPL-2.0-or-later with no paid edition, and it runs on standard Linux web stacks inside your own network. Umbraco can also be self-hosted under MIT, but confirm that your licensed add-ons and support plan allow it.
Headless delivery	Umbraco, for .NET front ends	Umbraco's Content Delivery API returns JSON but is opt-in and must be enabled in configuration. Drupal's core JSON:API suits decoupled front ends built on JavaScript frameworks. Choose by the front-end stack your team already runs.
Multilingual sites	Drupal	Drupal provides four core multilingual modules for interface, content and configuration translation. Confirm how Umbraco's multilingual setup and any paid add-ons meet your language and workflow requirements in a proof of concept.
Team with no in-house developers	Umbraco Cloud, or a managed partner	Umbraco Cloud is a fully managed service with backups, a CDN, HTTPS and Development, Staging and Live environments. Self-hosted Drupal needs an operator for PHP, database and module upgrades, unless you contract that work out.
Long-term upgrade planning	Depends on the release calendar	Umbraco 17 is LTS with end of life on November 27, 2028. Umbraco 13 reaches end of life on December 14, 2026. Drupal 10 reaches end of life on December 9, 2026, and Drupal 12 is scheduled for the week of December 7, 2026. Map your upgrade window against these dates.

How Drupal and Umbraco are built and deployed

Drupal and Umbraco both run as self-hosted web applications, but they sit on different runtimes, databases and hosting models. The cards below separate what the platform gives you from what your team must patch, back up and operate, which is where most of the day-to-day effort lands.

Drupal core and its PHP runtime

Drupal runs on PHP, and the required version rises with each major release. Drupal 10 requires PHP 8.1 or later, Drupal 11 requires PHP 8.3 or later, and Drupal 12 requires PHP 8.5 or later. Your team owns the PHP runtime and the web server, which can be Apache, Nginx or another server. Check that your hosting image can move to the newer PHP version before you commit to a Drupal 12 timeline.

Database choice for Drupal

Drupal 11 supports MariaDB, MySQL, PostgreSQL and SQLite, and Microsoft SQL Server and MongoDB are available only through contributed modules. Your database team therefore runs the engine, backups and patching on infrastructure you already manage. Confirm the database version against the current requirements before you pick a platform image, because the minimum versions are set per engine and change over time.

Umbraco on .NET 10.0 or higher

Umbraco is a .NET application, so it needs a .NET 10.0 or higher runtime and a Windows or Linux host that your .NET team already supports. Current documentation supports SQLite or SQL Server as the installation database. Your team owns the .NET runtime, IIS or Kestrel hosting and SQL Server patching if you self-host. Ask whether your organization's Microsoft licensing and support agreements cover the server and database editions you plan to use.

Umbraco Cloud on Azure environments

Umbraco Cloud is a managed service on Microsoft Azure that provides Development, Staging and Live environments, automatic backups, a global CDN and HTTPS. Umbraco Deploy moves content and structure between environments. The managed model shifts runtime patching and backups to Umbraco, but it limits where you host and what you can install on the server. Confirm data residency, the Azure region and any network controls you need before you choose it over self-hosting.

Content Delivery API as opt-in JSON

The Umbraco Content Delivery API returns content as JSON for headless front ends, but it is off until you enable it in configuration. Unpublished content appears only in preview with an API key, and protected content needs member authentication turned on. Your team must decide who can reach the API and how preview is secured before a decoupled front end goes live. Compare this with Drupal, where a headless setup usually relies on the core JSON:API module.

What each license covers and what is paid for

Drupal core and the contributed files hosted on Drupal.org are licensed under the GNU General Public License, version 2 or later (GPL-2.0-or-later). There is no paid edition of Drupal itself, so the software cost is zero and every spend goes to people, hosting or third-party services.

Core license: Drupal and derivative works hosted on Drupal.org are GPL-2.0-or-later, which governs how you may distribute modified code.
Contributed modules: Contributed projects on Drupal.org fall under the same terms, so a module you adopt carries the same obligations as core.
No paid edition: You do not buy a Drupal license tier. Budget for build partners, hosting, maintenance and any commercial modules or services you choose.
Extended support: Drupal 7 security support ended on January 5, 2025, and the Drupal Association lists certified Extended Security Support Provider vendors for sites that cannot migrate yet. Those services are paid separately.

Confirm with your legal team how GPL obligations apply if you modify code and distribute it, and ask any vendor whether their proprietary add-ons sit outside the GPL boundary.

Capabilities that decide the shortlist, side by side

This table sets Drupal and Umbraco against the capabilities that usually settle a shortlist, from license and runtime to support windows and identity options. Read each row as a question to answer in your own environment, and treat any cell marked for confirmation as a proof-of-concept item rather than a settled fact. The main takeaway is that the two platforms differ most on runtime and licensing of add-ons, not on the open-source core itself.

Capability	Drupal	Umbraco
License	GPL-2.0-or-later for Drupal core and contributed files hosted on Drupal.org; no paid edition of Drupal itself	MIT for the Umbraco-CMS repository; Umbraco Forms and Umbraco Engage are licensed add-ons
Language and runtime	PHP. Drupal 11 requires PHP 8.3 or later; Drupal 12 requires PHP 8.5 or later	C# on .NET. Current Umbraco documentation requires .NET 10.0 or higher
Databases	Drupal 11 supports MariaDB 10.6+, MySQL 8.0+, PostgreSQL 16+ and SQLite 3.45+; SQL Server through contributed modules (confirm current status)	Installation supports SQLite or SQL Server (confirm other engines with the vendor)
Version and LTS model	Major versions roughly every three years; Drupal 11 is current, Drupal 12 scheduled for the week of December 7, 2026, Drupal 10 end of life December 9, 2026	Umbraco 17 is an LTS release published November 27, 2025, end of life November 27, 2028; Umbraco 13 end of life December 14, 2026
Managed hosting option	No vendor-managed Drupal hosting from Drupal.org; hosting is chosen with third-party providers (confirm options with each provider)	Umbraco Cloud, a managed service on Microsoft Azure with backups, CDN, HTTPS and Development, Staging and Live environments
Headless delivery	Core JSON:API module for decoupled front ends; traditional rendering is the default	Content Delivery API returns JSON, opt-in, enabled in configuration; protected content requires member authentication
Paid add-ons	No paid add-on required for core; contributed modules are free, though some support providers are paid (confirm per module)	Umbraco Forms needs a license on a public domain; Umbraco Engage needs a license covering one production domain
Identity integration	Contributed SAML Authentication (samlauth) and OpenID Connect modules; confirm Entra ID and Active Directory fit in a proof of concept	Identity options beyond the Content Delivery API member model are not covered by our sources; confirm SSO support with the vendor

How SAML and OpenID Connect sign-in works on each stack

On Drupal, SAML sign-in comes from a contributed module. The samlauth module lets a Drupal site act as a SAML service provider, so your corporate identity provider issues the assertion and Drupal consumes it. Its latest stable release, 8.x-3.14, supports Drupal 10.3 and later and Drupal 11, so confirm that your target version falls in that range before you commit to the module, and treat Drupal 12 as a separate compatibility check. Ask the identity team which attributes the provider sends, such as email, groups and roles, and map them to Drupal roles during a proof of concept, because role mapping decides who can reach administrative pages. The samlauth project page lists the current compatibility details.

The contributed OpenID Connect module handles a different pattern. External OpenID Connect providers authenticate Drupal users, and Drupal creates a local account on first sign-in. That makes provisioning a policy decision: decide whether a first sign-in creates an account with no roles, and who approves role changes afterward, before go-live. The module ships built-in clients for generic OAuth 2.0, GitHub, Google, LinkedIn, Facebook and Okta, so an Okta tenant can be wired up without custom code. A generic OAuth 2.0 or OpenID Connect client still needs your provider's endpoints and client credentials configured, and a project page on Drupal.org documents the settings to check.

Umbraco takes a narrower route for this question. Its Content Delivery API is the headless surface, and it is opt-in, so it must be enabled in configuration before anything is served. Protected content comes through the API only when member authentication is enabled, which means gated content for a partner portal or a separate front end needs member login designed and tested as part of that feature. Preview of unpublished content also requires an API key, a separate credential your team must issue, store and rotate. Whether Umbraco can federate sign-in with your Microsoft identity tenant, which SAML or OpenID Connect options are available, and how they are configured are points to confirm in the Content Delivery API documentation and the Umbraco documentation for your version, or in a proof of concept, not assumptions to carry into a design.

What drives running cost and the upgrade timeline

Running Drupal and Umbraco costs differ less in license fees than in who hosts the site, which runtime skills you pay for, and how often you must move to a new major version. The cards below separate the recurring cost drivers from the dated support windows that set your upgrade calendar.

Hosting and infrastructure

A self-hosted Drupal site runs on your web servers and a supported database (MariaDB, MySQL, PostgreSQL or SQLite), so you carry patching, backups, scaling and CDN decisions. Umbraco Cloud is a managed service on Microsoft Azure with automatic backups, a global CDN, HTTPS and Development, Staging and Live environments. Ask each vendor or partner to price the environments, backups and monitoring you need in writing, and confirm whether the Umbraco Cloud tier you need includes the environments your release process depends on.

Skills and staffing

Drupal sites are built and run by PHP developers, while Umbraco requires .NET skills, with current documentation calling for .NET 10.0 or higher. Your cost depends on whether your existing team already holds one of these skill sets and whether you can hire it at your location. Ask for named roles, hours per month for run support, and whether the partner covers both development and operations.

License fees for add-ons

Both core products are free to download, so recurring license cost comes from add-ons. Umbraco Forms runs unrestricted locally but needs a valid license on a public domain, sold per domain with subdomains included. Umbraco Engage needs a license covering one production domain and up to two development or testing domains. Count every public domain, including campaign and regional sites, and ask the vendor to confirm renewal terms.

Drupal 10 and Drupal 12 timing

Drupal 10 reaches end of life on December 9, 2026, with no new Drupal 10 releases after that date. Drupal 12 is scheduled for the week of December 7, 2026, and requires PHP 8.5 or later. A Drupal 10 site will need a planned move to Drupal 11 or a supported later release before it loses security coverage. Ask for an upgrade estimate that covers contributed modules, custom code and theme work, not only core.

Umbraco 13 and 17 windows

Umbraco 13 reaches end of life on December 14, 2026, with XLTS ending December 14, 2028 and Umbraco Cloud service ending December 14, 2029. Umbraco 17 is an LTS release that reaches end of life on November 27, 2028, with XLTS on November 27, 2030 and Umbraco Cloud service ending November 27, 2031. Hosting on Umbraco Cloud continues for the duration of XLTS, up to 24 months, then projects can run on dedicated resources for 12 months after XLTS ends. Confirm how that dedicated hosting is priced before you choose a version.

What to request in a quote

Ask for a line-item quote covering build, migration, hosting or cloud tier, add-on licenses by domain, and recurring run support. Request the upgrade plan for the next major version of each platform, with the work for modules or packages, testing and cutover listed separately. Ask whether the scope includes a Drupal 10 to 11 or Umbraco 13 to 17 path, and what is excluded. Fixed-scope agreements make these assumptions easier to compare.

Moving a site from Drupal to Umbraco or the reverse

This sequence turns a live site into an inventory, a rebuild plan and a tested cutover, so the content, users and URLs that matter survive the move. Each step produces a written artifact that the next step depends on.

Inventory content, users, media and integrations
The content owner and a platform engineer list every content type, field, taxonomy, user role, media library, URL pattern, form, search index and third-party integration on the current site. A solutions architect checks the list against analytics to find pages that still receive traffic. The step is done when the inventory is signed off by the business owner and each item is marked keep, merge or retire.
Decide what is rebuilt and what is moved
The team decides which parts are carried over as data and which are rebuilt as code. Front-end templates and themes are rebuilt on the target platform, because Drupal 6 and 7 themes cannot be migrated and the same rebuild applies when moving off Umbraco. Confirm with the vendor or your own proof of concept whether a supported migration path exists between Drupal and Umbraco, since the supplied facts cover Drupal migration tooling (Migrate, Migrate Drupal and Drush) but do not describe an Umbraco migration path. The output is a written decision log that names every component as moved or rebuilt.
Map content models to the target document types
A content architect maps each Drupal content type, its fields and its taxonomy references onto Umbraco document types, compositions and data types, or the reverse. Entity references, revisions and translation settings are mapped explicitly, because they rarely translate one to one. The check is a mapping table reviewed with editors, with an illustrative sample page migrated by hand to confirm that the model holds the content without loss.
Migrate content, media and users
The team runs a scripted migration of content, media files and user accounts into the target environment, starting in a non-production copy. Passwords and login methods need a decision, since many platforms cannot export hashed passwords across systems, so plan a reset or federated sign-in path. The check is a reconciliation report that counts items by type on both sides and lists every record that failed, with each failure resolved or accepted in writing.
Rebuild forms and personalization against license terms
Forms, personalization, A/B tests and campaign features are rebuilt on the target platform. On Umbraco, Umbraco Forms needs a valid license on a public domain and is sold per domain with two development or testing domains included, while Umbraco Engage needs a license covering one production domain and up to two development or testing domains. On Drupal, the equivalent functions come from contributed modules or custom code, which the team must review and maintain. The output is a feature matrix showing each function, its platform, its license or module source and its owner.
Set up identity and editor access
Platform engineers connect the target site to the organization's identity provider and map existing roles to the new permission model. For Drupal, SAML and OpenID Connect are available through contributed modules such as samlauth and openid_connect, and the team must confirm module support for its Drupal version. For Umbraco, confirm how the chosen authentication approach and member authentication work for protected content. The check is a test login for each role, with a documented list of accounts that cannot be migrated and need manual setup.
Run parallel environments and redirects
The new site runs alongside the old one in a staging environment that matches production in hosting, caching and integrations. The team maps every legacy URL to its new address, tests the redirects with a crawl, and checks that search engines, feeds and tracking tags still resolve. Editors run their normal workflow in both systems for a period the team sets in advance, and every defect is logged. The step is done when the redirect map has no unresolved legacy URLs and the defect log is closed.
Cut over and retire the old site with a rollback plan
The team freezes content edits on the old site, runs a final incremental migration, switches DNS or the load balancer, and confirms the new site serves production traffic. A rollback path is written and rehearsed before the switch, including who decides to roll back and how content created during the freeze is handled. The old site stays read-only and reachable for an agreed period before it is decommissioned. The output is a signed cutover record with the post-launch monitoring results attached.

What implementing each platform involves and where projects run long

Implementation effort on both platforms follows the same order: settle the content model, choose the theme or front-end approach, select modules or packages, set up identity, and only then size the hosting and support plan. On Drupal, the work centers on content types, fields, view modes and roles, plus picking contributed modules from the Drupal.org project list and checking each against your target Drupal version. Authentication is usually handled by a contributed module such as the SAML Authentication module or the OpenID Connect module, so the identity work is configuration and testing against your provider rather than new code. On Umbraco, the work centers on document types, compositions, templates and the Umbraco backoffice permissions, with the Content Delivery API enabled only if you need headless delivery. Identity typically means ASP.NET Core authentication wired to your directory, and that integration belongs in your estimate, not in an afterthought.

The delays that recur on both platforms are mostly decisions, not code. An unresolved content model is the most common: when editors and the business have not agreed on types, relationships and workflow states, every template and migration gets rebuilt. Third-party integrations (CRM, marketing, payment or search services) stall when API access and credentials are requested late. Multilingual scope expands quietly, so confirm early which locales need content, which only need interface strings, and who approves translations. On Umbraco, add-on licensing is a procurement task with its own lead time: Umbraco Forms needs a license for any public domain, and Umbraco Engage needs one covering the production domain and its development domains, so start those purchases before go-live rather than during user acceptance testing.

Upgrade timing is the delay most often underestimated, and it sits in the support plan. Confirm which major version you are launching on against the current end-of-life dates in the Drupal core release schedule and the Umbraco end-of-service policy, then ask the vendor or partner what the upgrade path is if a release reaches end of life within the first year of operation. Umbraco Cloud hosting carries its own service end dates, so a project pinned to a version approaching end of service will need a migration plan before its platform support ends. Whichever platform you choose, put release-window monitoring, patch testing and rollback steps in the written scope so that upgrades are scheduled work, not emergencies.

Questions buyers ask before hiring outside help

What drives the cost of a Drupal or Umbraco build?

The biggest drivers are the number of content types, integrations, custom modules or packages, design work and how many environments you need. Drupal has no license fee for the core platform, so its one-time build cost sits mostly in configuration, theming and contributed modules, while recurring costs come from hosting, maintenance and upgrades. Umbraco CMS is also free and MIT-licensed, but Umbraco Forms and Umbraco Engage need licenses on public domains, and Umbraco Cloud is a managed service with its own subscription. Ask any provider for a written scope that lists each integration, environment, add-on license and support period, because that is what a fair quote follows from. DeployOpen does not publish a price list; a quote follows from the agreed written scope.

Can our team run Drupal or Umbraco without outside help?

A team with PHP or .NET skills can run either platform, but the question is whether it has the capacity to handle upgrades, security patches and hosting on a schedule. Drupal core ships bugfix releases on the first Wednesday of each month and security releases on the third Wednesday, and new major versions typically arrive every three years, so someone must own that cadence. Umbraco requires .NET 10.0 or higher for current documentation and supports SQLite or SQL Server, so your staff must know that stack. If your team has these skills and time, you may not need an outside partner for every task, but you should confirm that ownership is written down before go-live. DeployOpen offers ongoing support and upgrades as retainers, which you can scope alongside or instead of a one-time build.

How long does a migration take and what sets that time?

Migration time depends mostly on the volume and structure of existing content, the number of templates to rebuild and how much data needs cleaning. For Drupal 6 or 7 sites, the Drupal.org documentation says you cannot simply update to Drupal 10 or later; you migrate into a new site, and themes must be rebuilt because they cannot be migrated. Drupal 7 security support ended on January 5, 2025, so older sites carry more urgency. Umbraco 13 reaches end of life on December 14, 2026, which may also drive a move to Umbraco 17. Ask for a timeline in the written scope that separates content mapping, theme rebuild, integration testing and cutover, and confirm which steps depend on your data owners.

Do Umbraco Forms or Engage need a license on a staging site?

Umbraco Forms runs unrestricted locally but requires a valid license on a public domain, and each license covers two development or testing domains. Umbraco Engage requires a valid license covering one production domain and up to two development or testing domains when it runs on a public domain. Staging environments are usually treated as testing domains, but you should confirm the exact domain count and the rules for subdomains with Umbraco and your licensing contact before you plan the environments. Ask the implementation partner to list every domain, environment and license in the written scope so that no license gap appears at launch.

Does Umbraco Cloud remove the need for DevOps?

Umbraco Cloud reduces infrastructure work because it is a managed service on Microsoft Azure with automatic backups, a global CDN, HTTPS and Development, Staging and Live environments. It does not remove every operational task, since you still own content governance, add-on configuration, custom code, release testing and the decisions about when to upgrade. Umbraco's end-of-service policy also sets dates: Umbraco 17 reaches end of service on Umbraco Cloud on November 27, 2031, and hosting continues for the duration of Extended Long-Term Support, a phase of up to 24 months. If you self-host instead, the work moves to your own infrastructure team, so compare the two in the written scope rather than assuming either removes the effort.

What does the work need from our team?

The work needs named decision-makers, technical contacts with access to your identity provider, hosting accounts and existing content, and staff who can approve designs and test each release. For Drupal, identity work may involve the contributed SAML Authentication module or OpenID Connect module, so your identity team should confirm which protocol and provider you use. For Umbraco, your team needs .NET and Azure access if you use Umbraco Cloud or your own hosting. Ask the provider to list these dependencies, the review rounds included and who signs off each milestone, because delays usually come from unavailable approvers rather than from the build itself.

What should we confirm before comparing written quotes?

Confirm the platform version, the support window, the hosting model, the licenses and the environments each quote covers. Check whether the quote includes security testing, backup and restore testing, documentation and handover, and whether ongoing support is priced separately as a retainer. Make sure every add-on license is named, and ask what happens when a major version reaches end of life during the project. DeployOpen plans, implements, hardens, backs up, upgrades and documents self-hosted platforms in your own infrastructure, and most engagements are fixed-scope with deliverables and timelines agreed in writing before work starts.

How DeployOpen helps teams choose, implement or migrate

DeployOpen is a Chainscore Labs company that plans, implements, customizes, integrates, hardens, backs up, upgrades, documents and supports self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks. For Drupal vs Umbraco, that means starting from your hosting stack, identity setup and add-on licensing before any platform decision is made.

How we scope

Written scope covers which Drupal or Umbraco version, hosting target and database you need.
Scope lists which Umbraco Forms or Engage domains require licenses and which environments they cover.
Engagements are fixed-scope, with deliverables and timelines agreed in writing before work starts.

How we build

We implement the chosen platform in your infrastructure, including identity integration with your existing provider.
Content models, editorial roles, theming or headless API setup follow the agreed scope.
Security testing of the built site and its APIs is available as part of the engagement.

How we hand over

Handover includes configuration, runbooks and documentation for upgrades, backups and restores.
Upgrade plans map each major version's support window against your own release calendar.
Compliance evidence is prepared for your assessor, though DeployOpen does not issue audit reports or certifications.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after handover.
Retainers can cover the move to the next LTS or major release before end of life.
Quotes follow from the written scope, so ask for line items covering licenses, hosting and effort.

Drupal vs Umbraco