> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/multi-tenant/onboard-cortex-xsoar-multi-tenant/step-1.-install-cortex-xsoar-for-multi-tenant.md).

# Step 1. Install Cortex XSOAR for multi-tenant

To install a multi-tenant, you need to log into Cortex Gateway, a portal for downloading the relevant image file and license. The same image applies to the main tenant, the development tenant (if relevant), and child tenants. When installing the tenants, set up the main tenant first.

{% hint style="info" %}

### Important

We recommend configuring SSO for the main tenant and the child tenant. If the main tenant is configured with SSO and the child tenant is not, you can't log into the child tenant directly. Accessing the child tenant will only be possible from the main tenant.
{% endhint %}

**Before you begin**

* Plan whether to install a standalone or a cluster.

  Cortex XSOAR supports standalone or cluster installation.

  Cluster installation is suitable for large-scale data production environments, offering scalability and High Availability. Standalone is ideal for small-scale data scenarios. For more information, see [Installation](/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/installation-overview.md).

  You can deploy a single node (standalone) or a cluster (three or more nodes).
* Review the [System Requirements](/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/system-requirements.md).

  <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>If you want to use the extra-small scale, you can’t use the Threat Intel Management (TIM) module. If you are using TIM, you need to use the small scale and above.</p><p>You don't need to follow the same sizing requirements for all tenants. For example, a main tenant can use a small scale while a child tenant can use a medium scale.</p></div>
* Have a basic understanding of how to deploy OVA or VHD file formats.
* For each tenant, add DNS records that point the following host names to the cluster IP address.
  * Cluster FQDN: The Cortex XSOAR DNS name for accessing the UI. For example, `xsoar.mycompany.com`.
  * API-FQDN: The Cortex XSOAR DNS name mapped to the API IP address. For example, `api-xsoar.mycompany.com`.
  * ext-FQDN: The Cortex XSOAR DNS name mapped to the external IP address. For example, `ext-xsoar.mycompany.com`.

Cortex XSOAR supports the following installation file packages, which you download from Cortex Gateway:

| Image file | Platform                                                                                            |
| ---------- | --------------------------------------------------------------------------------------------------- |
| OVA        | <p>Deploy on the following supported platforms:</p><ul><li>AWS</li><li>OCI</li><li>VMWare</li></ul> |
| VHD        | Deploy on Microsoft Hyper-V.                                                                        |

To set up your multi-tenant deployment, you must have a multi-tenant/MSSP license, such as **PAN-DEMISTO-MSSP**. After downloading the installation package from Cortex Gateway, you can install it on development and child tenants.

Although the order in which you install the tenants doesn't matter, this procedure installs the main tenant, the development tenant (if relevant), and the child tenant. When you reach the Cluster installation stage on each tenant, you must select the relevant **Installation Mode**.

<details>

<summary>Task 1. Install the main tenant</summary>

1. From Cortex Gateway, in the **Available for Activation** section, use the serial number to locate the tenant to download.
   1. Click **Download On Prem**.
   2. Select one of the following:
      * **Production - Multi-Tenant**
      * **Dev**

        Select **Dev** if you want to use a production and development tenant with a private remote repository. If you don't select a development tenant now, you can install one later.
   3. Download one of the following image files.
      * **OVA**: Supported by VMWare, AWS, and OCI.
      * **VHD**: Supported by Microsoft Hyper-V.
2. Depending on the image file and the platform you want to deploy on, do one of the following:

   * [Install Cortex XSOAR on a VM deployed on AWS](/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-aws.md)
   * [Install Cortex XSOAR on a VM deployed on OCI](/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-oci.md)
   * [Install Cortex XSOAR on a VM deployed on Hyper-V](/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-hyper-v.md)
   * [Install Cortex XSOAR on a VM deployed on VSphere](/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-vsphere.md)

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Important</h3><p>When installing Cortex XSOAR on your virtual machine, from the textual UI, in the <strong>Installation Mode</strong> field, you must select <strong>Parent Tenant</strong>. For more information, see Task 6. Install Cortex XSOAR on your VM for your installation platform.</p></div>
3. After installation, add the license.

   1. Go to **Settings & Info** → **Cortex XSOAR License**.
   2. In the **Upload License** section, drag and drop the production license file.

      The license file is in JSON format.

   For more information, see [Post-installation](/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/post-installation.md).
4. (Optional) Perform post-installation maintenance, including scaling up hardware resources and using your X.509 certificate for a secure HTTP connection.

</details>

<details>

<summary>Task 2. Install the development tenant (if required)</summary>

1. Do one of the following:
   * If you select **Dev** when downloading the installation package for the main tenant, install Cortex XSOAR, as described in step 2 below.
   * If you didn't select **Dev** when downloading the installing package in Cortex Gateway, do the following:
     1. In the **Available for Activation** section, find the tenant you downloaded in Task 1 above.
     2. Click **Download On Prem**.
     3. Select **Dev**.
     4. Click **Next**.
     5. Download one of the following image files:

        * OVA
        * VHD

        <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>You are not restricted to using the platform installed on the main tenant. For example, if you have downloaded an OVA file and installed the VM on AWS on the main tenant, you can install the VM on OCI in the development tenant.</p></div>
2. Depending on the image file and the platform you want to deploy on, do one of the following:

   * [Install Cortex XSOAR on a VM deployed on AWS](/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-aws.md)
   * [Install Cortex XSOAR on a VM deployed on OCI](/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-oci.md)
   * [Install Cortex XSOAR on a VM deployed on Hyper-V](/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-hyper-v.md)
   * [Install Cortex XSOAR on a VM deployed on VSphere](/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-vsphere.md)

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Important</h3><p>In the textual UI menu, when you reach the <strong>Cluster Installation</strong> stage, in the <strong>Installation Mode</strong> field, select <strong>Enterprise</strong>.</p></div>
3. After installation, add the non-production license.

   1. Go to **Settings & Info** → **Cortex XSOAR License**.
   2. In the **Upload License** section, drag and drop the non-production license file.

      The license file is in JSON format.

   For more information, see [Post-installation](/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/post-installation.md).
4. (Optional) Perform post-installation maintenance, including scaling up hardware resources and using your own X.509 certificate for a secure HTTP connection.

   For more information, see [Post-installation](/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/post-installation.md).

</details>

<details>

<summary>Task 3. Install the child tenant</summary>

1. Do one of the following:
   * If you want to use the same installation package as the main/development tenant, install Cortex XSOAR, as described in step 2 below.
   * If you want to install a different installation package, do the following:
     1. In the **Available for Activation** section, find the tenant you downloaded in task 1.
     2. Click **Download On Prem**.
     3. Select **Production - Multi-Tenant**
     4. Click **Next**.
     5. Download one of the following image files:

        * OVA
        * VHD

        <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>You are not restricted to using the platform installed on the main tenant. For example, if you have downloaded an OVA file and installed the VM on AWS on the main tenant, you can install the VM on OCI in the child tenant.</p></div>
2. Depending on the image file and the platform you want to deploy on, do one of the following:

   * [Install Cortex XSOAR on a VM deployed on AWS](/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-aws.md)
   * [Install Cortex XSOAR on a VM deployed on OCI](/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-oci.md)
   * [Install Cortex XSOAR on a VM deployed on Hyper-V](/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-hyper-v.md)
   * [Install Cortex XSOAR on a VM deployed on VSphere](/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/install-cortex-xsoar-on-a-vm-deployed-on-vsphere.md)

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Important</h3><p>In the textual UI menu, when you reach the <strong>Cluster Installation</strong> stage, do the following:</p><ul><li><p>In the <strong>Cluster FQDN</strong> field, add the child tenant FQDN.</p><p>The child tenant must have the same tenant name as the child tenant in Cortex XSOAR 6. if the names are different, data transfer fails in the pre-migration wizard.</p></li><li>In the <strong>Installation Mode</strong> field, select <strong>Child Tenant</strong>.</li></ul></div>
3. (Optional) Perform post-installation maintenance, including scaling up hardware resources and using your own X.509 certificate for a secure HTTP connection.

   For more information, see [Post-installation](/cortex-xsoar-8-on-prem/8.13/install-cortex-xsoar/post-installation.md).

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>You don't need to add a license. The license page is available only on the main and development tenants.</p></div>
4. After installing both the main tenant and child tenants, you can pair the child tenant to the main tenant.

</details>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.13/multi-tenant/onboard-cortex-xsoar-multi-tenant/step-1.-install-cortex-xsoar-for-multi-tenant.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.