An engineer needs to migrate Cortex XDR agents without internet connection from Cortex XSIAM tenant A to Cortex XSIAM tenant B. There is a broker…

Before migration, the endpoints must have a path to the new tenant.

1) Deploy a new Broker VM (Broker C) and register it to Cortex XSIAM tenant B (option B); this provides a local connection for the offline agents to the target tenant.

2) From tenant A’s console, edit the selected endpoints and add Broker C as an additional proxy (option D). When the agents receive this setting, they begin communicating through Broker C to tenant B, after which they can be reassigned. A Broker VM can be registered to only one tenant, so re-registering Broker A or installing Broker C in tenant A does not satisfy the requirement.

A. Registers Broker C to tenant A; does not create a communication path to tenant B for migration.

C. A Broker VM can only be registered to one tenant; adding Broker A to tenant B breaks its current registration.

1. Palo Alto Networks, “Cortex XSIAM Broker VM Guide” v2.4, Section ‘Register a Broker VM’, p. 7: “A Broker VM can be registered to only one Cortex tenant at a time.”

2. Palo Alto Networks, “Cortex XSIAM Administrator Guide” (2023-10), Chapter ‘Reassign Cortex Agents to a Different Tenant’, Steps 1-3, pp. 312-314.

3. Palo Alto Networks, “Configure Endpoint Proxies”, Cortex XSIAM Online Help, paragraph ‘Add a new proxy to existing endpoints’ (accessed 2025-11-29).