[Data Ingestion and Integration] A multinational company with over 300,000 employees has recently deployed Cortex XDR in North Americ a. The solution…

Cortex XDR and the Cloud Identity Engine (CIE) are regionalized services. A Cortex XDR tenant is provisioned in a specific geographic region (e.g., North America, Europe) to comply with data sovereignty regulations like GDPR. The data collected and processed by this tenant, including identity data from CIE, is stored within that region. For a large multinational company, it is standard practice to have separate tenants for different regions. Therefore, the North American tenant would not have access to identity data collected for a European tenant, leading to the missing details for European users.

B. The question implies the integration is working for North American users, so the plug-in has been configured, but likely only for the North American Active Directory domains.
C. The Cloud Identity Engine does not need to be "activated" in all regions for a single tenant. Rather, data sources from different regions must be configured to feed the appropriate regional tenant.
D. The ITDR add-on is specifically designed to integrate with and leverage data from the Cloud Identity Engine, making this statement factually incorrect.

1. Palo Alto Networks Cortex XDR Administrator's Guide. "Manage Cortex XDR Tenants". The documentation states: "When you activate a new Cortex XDR tenant, you must select the region where you want Cortex XDR to store your data." This establishes the fundamental principle of regional data isolation.

2. Palo Alto Networks, "Cortex Data Lake". The documentation on data residency explains that logs and data are stored and processed within the selected region, enforcing data sovereignty. This architectural constraint is the basis for why an NA tenant would not see EU data.