> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/xsoar-migration-guide/cortex-xsoar-8-saas-multi-tenant-migration/migrate-from-cortex-xsoar-6-multi-tenant-to-cortex-xsoar-8-saas-multi-tenant-using-the-migration-wiz/step-3.-run-user-acceptance-tests-uat-in-a-multi-tenant-deployment-using-the-migration-wizard/security-and-authentication-multi-tenant.md). # Security and Authentication - Multi-Tenant You must update your settings in all tenants (main, child, and development). Security Settings Go to **Settings & Info** → **Settings** → **System** → **Security Settings** to add your approved IP ranges and domains. Allow your Cortex XSOAR 6 server IP address and, if using an engine, your engine's IP addresses. For more information, see [Security Settings](/cortex-xsoar-8-saas/onboard-cortex-xsoar/post-deployment/configure-system-settings/configure-security-settings.md). SAML and SSO You can authenticate users by doing one or both of the following options: * User authentication in the Customer Support Portal Any user who has a Customer Support Portal (CSP) account can be permitted to access your tenants and log in to them through the Cortex Gateway or to the tenant directly. When users log into the Cortex Gateway or the tenant (provided they are assigned a role) they are prompted to sign into the CSP using their username and password. This is the default method of authentication. As soon as they are added to the CSP, you can manage them in the Cortex Gateway or the Cortex XSOAR tenant. You can also manage roles in the Cortex Gateway and the Cortex XSOAR tenant. * SAML Single Sign-On Enables the user to log into Cortex XSOAR via SSO by configuring SSO. You define Cortex XSOAR authentication in your identity provider’s account, such as OKTA, and configure the SSO settings in Cortex XSOAR. SAML 2.0 authentication must be set up separately for your main, child, and development tenants. There is no propagation of SSO from the main tenant to child tenants. In Cortex XSOAR 6, to configure SAML 2.0, you need to create and enable a SAML 2.0 integration instance. In Cortex XSOAR 8, you no longer need to do this, as it is replaced by the SSO management configuration. As the SSO management configuration is not added to Cortex XSOAR 8, you need to reconfigure it during the UAT. SSO and authorization for communication tasks rely on the URL defined on the IDP, which points to the Cortex XSOAR 6 URL. For more information, see [Authenticate Users using SSO](/cortex-xsoar-8-saas/configure-cortex-xsoar/users-and-roles-management/set-up-authentication/authenticate-users-using-sso.md). {% hint style="info" %} ### Note * You can view SSO users from the Cortex Gateway, but SSO users do not have access to the Cortex Gateway. * You can have multiple IdP providers with separate SSO configurations on a tenant. For example, for a co-managed tenant, an MSSP and an end customer would use different providers for the same tenant. {% endhint %} If you do not want a user to have access to all tenants, the user should be added using SSO in each tenant. For example, for an MSSP with co-managed tenants (a tenant where management is shared between the MSSP and the end customer), the MSSP’s analysts and the end customer’s analysts need access to the child tenant. If the MSSP’s analysts need access to every child tenant (for multiple end customers), you can either add them in the CSP or through SSO, by configuring SSO for the main tenant and each child tenant. To restrict their access to only one tenant, the end customer’s analysts must have SSO access configured directly on the child tenant. End-customer users should not be created as users in the CSP. How to authenticate users using SSO 1. Before changing your SSO configuration for Cortex XSOAR 8, confirm you have at least one active CSP user with the Instance Admin or Account Admin role, to prevent being locked out of Cortex XSOAR if there is an SSO configuration error. 2. To change your SSO configuration, go to Settings & Info → Settings → Access Management → **Authentication Settings**. 3. **Switch to XSOAR 8 Configurations** and follow the instructions to [Configure Single Sign-On Using SAML 2.0](/cortex-xsoar-8-saas/configure-cortex-xsoar/users-and-roles-management/set-up-authentication/authenticate-users-using-sso.md). If you are using Okta or Azure AD as your IdP, follow the instructions specific to your IdP. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/xsoar-migration-guide/cortex-xsoar-8-saas-multi-tenant-migration/migrate-from-cortex-xsoar-6-multi-tenant-to-cortex-xsoar-8-saas-multi-tenant-using-the-migration-wiz/step-3.-run-user-acceptance-tests-uat-in-a-multi-tenant-deployment-using-the-migration-wizard/security-and-authentication-multi-tenant.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.