> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/onboard-and-configure-cortex-xpanse/step-1-activate-cortex-xpanse.md). # Step 1: Activate Cortex Xpanse Learn how to activate Cortex Xpanse in the Cortex Gateway. Before setting up Cortex Xpanse, you must activate the Cortex Xpanse tenant in the Cortex Gateway. The Cortex Gateway enables you to perform the following actions: * Activate new tenants. * View and manage existing tenants and tenants available for activation that are allocated to your [Customer Support Portal (CSP) account](https://support.paloaltonetworks.com/). Activating a Cortex Xpanse Expander tenant is a one-time task you’ll need to perform before using Cortex Xpanse. You only need to repeat the activation if you want to add additional tenants. Before you activate Expander, complete the following prerequisites : * Locate the email that contains your activation information. * Ensure you have CSP Super User role permissions to your existing administrator accounts. This role cannot be removed or changed through the Cortex Gateway. * Review the [Data residency and transmission](#data-residency-and-transmission) information. ### How to activate Cortex Xpanse 1. Navigate to the activation link you received in the email and sign in to begin activation in the [Cortex Gateway](https://cortex-gateway.paloaltonetworks.com/).

Note

As the first user with CSP Super User permissions to access the Cortex Gateway, you are automatically granted Account Admin permissions. With these permissions, you are able to activate Cortex Xpanse tenants.

The Gateway displays tenants **Available for Activation** and **Available Tenants**. In the **Available for Activation** section, you can view all the tenants allocated to your CSP account that are ready for activation. You can review the tenant details, such as serial number and purchase date. The **Available Tenants** section lists tenants that have already been activated. If you have more than one CSP account, the tenants are displayed according to the CSP account name. 2. In the **Available for Activation** section, locate the tenant you want to activate according to the serial number and **Activate** to launch the **Tenant Activation** wizard. 3. In Tenant Activation → **Define Tenant Settings**, define the following tenant details. * **Tenant Name**—Give your Cortex Xpanse app instance an easily-recognizable name. Choose a name that is 59 or fewer characters and is unique across your company account. * **Region**—Select a region in which you want to set up your Cortex Xpanse instance. * **Tenant Subdomain**—Give your Cortex Xpanse instance an easy-to-recognize name that is used to access the tenant directly using the full URL (`https://.crtx..paloaltonetworks.com`).

Note

Note this is a public FQDN, so be careful with sensitive information such as the company name.

* Review and **agree to the terms and conditions of the Privacy Policy, Terms of Use, EULA**. 4. **Activate** your tenant. Activation can take up to an hour. Cortex Xpanse sends a notification to your email when the tenant has completed the activation process. 5. Select **Back to main gateway** and in the **Available Tenant** section, search for your tenant name. Hover over a tenant to display the **Tenant Status** and **License Details**. When the tenant displays an **Active** status, select the tenant name to confirm you can successfully access the Cortex Xpanse management console. ### Data residency and transmission * Data at Rest: All customer data at rest is stored strictly within your selected deployment region. * Standard Deployments: By default, connection endpoints utilize global edge acceleration (Global Load Balancing) to optimize connection performance and volumetric DDoS resilience, with traffic fully encrypted in transit to the deployment region. * Regional Only Compliance Deployments: For organizations with strict local regulatory requirements mandating that network traffic and TLS termination remain strictly within national borders, dedicated Regional Load Balancer endpoints are available upon request. When configured with regional endpoints, all data transmission and TLS handshakes terminate strictly within the specified cloud region. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xpanse/onboard-and-configure-cortex-xpanse/step-1-activate-cortex-xpanse.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.