> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-migration-guide/cortex-xsoar-8-saas-multi-tenant-migration/migrate-from-cortex-xsoar-6-multi-tenant-to-cortex-xsoar-8-saas-multi-tenant-using-the-migration-wiz/step-3.-run-user-acceptance-tests-uat-in-a-multi-tenant-deployment-using-the-migration-wizard/integration-instance-configuration-changes-multi-tenant.md). # Integration Instance Configuration Changes - Multi-Tenant This topic is relevant for all tenants (main, child, and development). Integration instances are copied to Cortex XSOAR 8. During the UAT phase, to avoid any conflicts, the following are disabled: * Integration instances that send emails, or other notifications (such as Slack or MS Teams) * Long-running integration instances * Fetching for integration instances * Mirroring for integration instances is ignored, and mirroring capability is disabled To test your integrations, temporarily enable them to verify connectivity and that mail configurations work properly. You should disable integrations after testing. For integrations that use external communication, such as sending emails, verify that you have added the Cortex XSOAR 8 IP Addresses to your firewall before testing. Both sets of IP addresses (Cortex XSOAR 6 and Cortex XSOAR 8) should remain in your firewall's allow list until migration is complete. {% hint style="info" %} ### Note * Integration instances are still active on the Cortex XSOAR 6 instance and may be affected by any action you take using integration instances in Cortex XSOAR 8. Integration instances created in Cortex XSOAR 8 during the UAT phase remain after the switchover date. If an integration instance differs between Cortex XSOAR 6 and 8 and you resync data at the switchover date, the Cortex XSOAR 6 values replace the Cortex XSOAR 8 values. If you do not resync data, the values in Cortex XSOAR 8 remain. * Integrations using deprecated content may not be migrated. You should update the deprecated content in Cortex XSOAR 6 before the start of the UAT phase so that the integration instance is migrated. For example, the Demisto REST API should be replaced by the Core REST API. If you do not do so, in Cortex XSOAR 8, update the content from Marketplace, and then create the integration instance. * If you have a custom (BYOI) integration that receives incoming traffic enabled on a custom port, your environment cannot be migrated at this time. {% endhint %} You need to reconfigure the following integrations:
Reconfigure integrations The following integrations need to be reconfigured by updating the URL and updating the client that accesses them to be URL-based only. If you use an IP for access, you must use an engine. | Integration | Description | Change Type | Comments | | ---------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ----------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | SAML | SAML authentication is part of the Cortex XSOAR platform. | Changed |

Note

As a part of the migration, the SAML integration is converted to the SSO settings on the platform level. In Cortex XSOAR 8, you need to Configure Single Sign-On Using SAML 2.0.

| | LDAP Authentication | Available in Cortex XSOAR 6. Currently not available in Cortex XSOAR 8. | Removed | | | Microsoft Teams | To use the rerouting configuration in Cortex XSOAR 8, you must use the Microsoft Teams content pack 1.4.43 or higher, and recreate the [Demiso Bot in Microsoft Teams](https://xsoar.pan.dev/docs/reference/integrations/microsoft-teams#create-the-demisto-bot-in-microsoft-teams). | Changed | For more information about Microsoft Teams and how to reconfigure it, see [Microsoft Teams](https://xsoar.pan.dev/docs/reference/integrations/microsoft-teams). | | [DUO](https://xsoar.pan.dev/docs/reference/integrations/duo#two-factor-authentication-with-duo-v31-and-up) | Not supported. | Removed | |
Core Rest API integration If you are using the[Core REST API](https://xsoar.pan.dev/docs/reference/integrations/core-rest-api) integration, review and test the integration instance (go to **Settings & Info** → **Settings** → **Integrations** → **Instances**, search for Core REST API, and click the **Settings** button). * In the **Core Server URL** field, the host address was modified to your Cortex XSOAR 8 FQDN. * In the **API Key** field: API keys are not migrated during the UAT. During the switchover, a new API key is generated, matching the permissions in the Cortex XSOAR 6 instance. To test the integration during the UAT, generate a new API key and configure the instance to use it. To ensure it is working correctly, test the integration instance. {% hint style="info" %} ### Tip We recommend testing this integration instance during the UAT phase. {% endhint %}
Mail Sender Configuration Cortex XSOAR 8 provides a built-in mail sender integration. It is installed out-of-the-box and does not require setting up an SMTP server or providing credentials. Emails sent via the built-in mail sender integration have a watermark that specifies the FQDN and mentions that the mail was sent via Cortex XSOAR. This protects against possible abuse of the built-in mail sender. By default, the built-in mail sender is disabled, and your mail sender from Cortex XSOAR 6 is used. You can enable the built-in mail sender and disable your previous mail server integration. During the User Acceptance Testing (UAT) phase, mail sender integrations are disabled by default. To test the built-in mail sender or your mail sender integration, enable the relevant integration instance. To temporarily enable a mail sender, go to **Settings & Info** → **Settings** → **Integrations** → **Instances**, click on the arrow next to your mail sender integration (or the built-in **Mail Sender** integration) and **Enable** the integration instance.
Long-running integrations Some long-running integrations provide internal data via API calls to your third-party software, such as a firewall. During the UAT phase, all long-running integrations are disabled by default. As Cortex XSOAR 6 is the working instance during the UAT phase, we recommend only enabling temporarily long-running integrations on Cortex XSOAR 8 for testing and then disabling them again until after the switchover date. {% hint style="info" %} ### Important * In Cortex XSOAR 6, a username and password are optional for long-running integrations. In Cortex XSOAR 8, they are required. If you are running a long-running integration on the tenant, you must have a username and password set up for the integration. The username and password can be set per integration, or universally for all long-running integrations on the **Settings & Info** → **Settings** → **Integrations** → **Long Running Integrations** page. * If you have long-running integrations running over a port (not via the instance) and are migrating from Cortex XSOAR 6 On-prem and they will not work in Cortex XSOAR 8 unless you either use an engine or configure the integration to work with the integration instance. {% endhint %} [Forward Requests to Long Running Integrations](/cortex-xsoar-8-saas/configure-cortex-xsoar/integrations/forward-requests-to-long-running-integrations.md) for Cortex XSOAR 8 and then update the URL, username, and password in your third-party software. For Cortex XSOAR SaaS, when configured without an engine, you may need to update long running integrations by changing the URL from `https:///instance/execute//` to `https://ext-.crtx..paloaltonetworks.com/xsoar/instance/execute/`. The following integrations are affected by this change: * O365 Teams (Using Graph API) * Generic Export Indicators Service * Generic Webhook * TAXII Server * TAXII2 Server * XSOAR-Web-Server * PingCastle * Publish List * Simple API Proxy * Syslog v2 * Web File Repository {% hint style="info" %} ### Note * The service is only accessible via URL. * The custom port configured for long-running integrations is ignored. * Custom certificates are not supported. * Authentication (username/password) is mandatory. * Update the client that accesses the integrations to be URL-based only. {% endhint %}
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/xsoar-migration-guide/cortex-xsoar-8-saas-multi-tenant-migration/migrate-from-cortex-xsoar-6-multi-tenant-to-cortex-xsoar-8-saas-multi-tenant-using-the-migration-wiz/step-3.-run-user-acceptance-tests-uat-in-a-multi-tenant-deployment-using-the-migration-wizard/integration-instance-configuration-changes-multi-tenant.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.