From 6d2746dbe5605f0254bad1a95159c4e9f42635c6 Mon Sep 17 00:00:00 2001
From: noydavidi <77931201+noydavidi@users.noreply.github.com>
Date: Wed, 15 Oct 2025 15:54:19 +0300
Subject: [PATCH 01/33] Update microsoft-auth-guide.md
---
content-repo/extra-docs/articles/microsoft-auth-guide.md | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/content-repo/extra-docs/articles/microsoft-auth-guide.md b/content-repo/extra-docs/articles/microsoft-auth-guide.md
index acca3f1b9..69f9e9b8b 100644
--- a/content-repo/extra-docs/articles/microsoft-auth-guide.md
+++ b/content-repo/extra-docs/articles/microsoft-auth-guide.md
@@ -12,10 +12,10 @@ More info at: [Device Code flow - Evolved phishing](https://www.microsoft.com/se
:::
-Microsoft's integrations (Graph and Azure) in Cortex XSOAR use Azure Active Directory applications to authenticate with Microsoft APIs. These integrations use OAuth 2.0 and OpenID Connect standard-compliant authentication services, which use an **Application** to sign-in or delegate authentication.
-For more information, see the [Microsoft identity platform overview](https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-overview).
+Microsoft's integrations (Graph and Azure) in Cortex XSOAR/XSIAM use Azure Active Directory applications to authenticate with Microsoft APIs. Those applications define the permissions and the roles for actions and XSOAR/XSIAM commands.
+Usually, you need to create your own application via Azure Portal and to set the API permissions, this is a self-deployed application. Alternatively, XSOAR/XSIAM suggests another solution where you can use the application XSOAR/XSIAM builds for you, this is the Cortex XSOAR application. In addition, for environments running within Azure, you can authenticate using Azure Managed Identities, which allow XSOAR/XSIAM to access Azure resources securely without managing credentials manually.
-There are three application authentication methods available:
+Therefore, there are three application authentication methods available:
1. [Cortex XSOAR Application](#cortex-xsoar-application)
2. [Self Deployed Application](#self-deployed-application)
From f4fd31b16ae60d0f3e4d420c6269c01729da5c11 Mon Sep 17 00:00:00 2001
From: noydavidi <77931201+noydavidi@users.noreply.github.com>
Date: Wed, 15 Oct 2025 15:59:54 +0300
Subject: [PATCH 02/33] Update microsoft-auth-guide.md
---
content-repo/extra-docs/articles/microsoft-auth-guide.md | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/content-repo/extra-docs/articles/microsoft-auth-guide.md b/content-repo/extra-docs/articles/microsoft-auth-guide.md
index 69f9e9b8b..52e1ceb7a 100644
--- a/content-repo/extra-docs/articles/microsoft-auth-guide.md
+++ b/content-repo/extra-docs/articles/microsoft-auth-guide.md
@@ -21,6 +21,8 @@ Therefore, there are three application authentication methods available:
2. [Self Deployed Application](#self-deployed-application)
3. [Azure Managed Identities](#azure-managed-identities-authentication)
+You must use one of those authentication methods.
+
## Cortex XSOAR Application
In this method, you grant consent for the Cortex XSOAR multi-tenant application to access your data. The application is maintained by Cortex XSOAR.
Depending on the integration, this requires either admin consent to [get access without a user](https://docs.microsoft.com/en-us/graph/auth-v2-service) or user consent to [get access on behalf of a user](https://docs.microsoft.com/en-us/graph/auth-v2-user).
@@ -37,15 +39,15 @@ To start the authentication process, go to the integration's detailed instructio
5. In the XSOAR Web Page that appears, click the **Start Authorization Process** button to initiate the authorization flow.
- You will receive your ID, token, and key. You need to enter this information, when you configure the integration instance in Cortex XSOAR.
-
+ You will receive your ID, token, and key. Go back to the instance configuration and copy: ID -> App/client ID, token -> Tenant ID, key -> Client Secret.
+ Click on "Test". The instance should be configured successfully.
## Self Deployed Application
To use a self-configured Azure application, you need to add a new Azure App Registration in the Azure Portal.
-The application must have the required permissions for the relevant APIs, which are documented in the integration documentation, for example see [Microsoft Defender Advanced Threat Protection required permissions](https://xsoar.pan.dev/docs/reference/integrations/microsoft-defender-advanced-threat-protection#required-permissions).
+The application must have the required permissions and roles for the relevant APIs, which are documented in the integration documentation, for example see [Microsoft Defender Advanced Threat Protection required permissions](https://xsoar.pan.dev/docs/reference/integrations/microsoft-defender-advanced-threat-protection#required-permissions).
To add the registration, refer to the [Microsoft documentation](https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app)
From 190832858e8fee412a8f455d77e56176a19adde0 Mon Sep 17 00:00:00 2001
From: noydavidi <77931201+noydavidi@users.noreply.github.com>
Date: Wed, 15 Oct 2025 16:48:06 +0300
Subject: [PATCH 03/33] Update microsoft-auth-guide.md
---
.../articles/microsoft-auth-guide.md | 59 +++++++++++++++----
1 file changed, 47 insertions(+), 12 deletions(-)
diff --git a/content-repo/extra-docs/articles/microsoft-auth-guide.md b/content-repo/extra-docs/articles/microsoft-auth-guide.md
index 52e1ceb7a..87b500afe 100644
--- a/content-repo/extra-docs/articles/microsoft-auth-guide.md
+++ b/content-repo/extra-docs/articles/microsoft-auth-guide.md
@@ -58,25 +58,60 @@ To add the registration, refer to the [Microsoft documentation](https://docs.mic
- For Microsoft Defender, select the appropriate cloud using the *Endpoint Type* parameter.
- For using the self-deployment option, select the *Custom* option and follow the instructions below.
-- Some Cortex XSOAR-Microsoft integrations support the deployment of national clouds through the self-deployed
+- Some Cortex XSOAR/XSIAM Microsoft integrations support the deployment of national clouds through the self-deployed
authorization flow. For more information about Microsoft National Clouds, refer to the [Microsoft documentation](https://docs.microsoft.com/en-us/graph/deployments).
In order to use a national cloud, change the *Server URL* parameter to the corresponding address of the national cloud you are using.
### Client Credentials Flow
-Some Cortex XSOAR-Microsoft integrations use the [client credentials flow](https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-client-creds-grant-flow).
-The Tenant ID, Client ID, and Client secret are required for the integration.
+Some Cortex XSOAR/XSIAM Microsoft integrations use the [client credentials flow](https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-client-creds-grant-flow).
+The Tenant ID, Client ID, and Client secret are required for the integration. You can get those values from the Azure Portal under the application information.
+
+1. Enter the Azure Portal.
+2. Search for you application using your application name or ID. You can search for it under the "App registrations" or to use the search bar.
+3. Where you find the application, click on it and go to the Overview section.
+4. Copy the "Application (client) ID" and paste it under the App/Client ID parameter field in the instance configuration in XSOAR/XSIAM.
+5. Copy the "Directory (tenant) ID" and paste it under the Token/Tenant ID parameter field in the instance configuration in XSOAR/XSIAM.
+6. In the application cofiguration go to "Certificates & secrets" and click on "New client secret", click on "Add" and copy the secret **value**. Paste it under the Client Secret parameter field in the instance configuration in XSOAR/XSIAM.
+7. In the instance configuration, select the ***Use a self-deployed Azure Application*** checkbox in the integration instance configuration.
+8. Test and Save the instance.
+
+Alternatively, instead of providing the *Client Secret*, you can authenticate using certificate credentials by providing:
+ * Certificate Thumbprint - The certificate thumbprint as appears when registering the certificate to the App
+ * Private Key - The private key of the registered certificate
+
+ You can find more information about it in [Microsoft Documentations]((https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-certificate-credentials) or to follow the next steps in case of Linux system operation:
+ 1. Run
+ openssl genrsa -out MyXSOARApp.key 2048
+ openssl req -new -x509 -key MyXSOARApp.key -out MyXSOARApp.crt -days 365 -subj "/CN=MyXSOARApp"
+ openssl x509 -in MyXSOARApp.crt -noout -fingerprint -sha1
+
+2. You will get results such as:
+ sha1 Fingerprint=E4:64:9A:AD:13:A4:F4:E0:74:11
-To configure a Microsoft integration that uses this authorization flow with a self-deployed Azure application:
+3. Remove the colons, this is your certificate thumbprint. For example:
+ E4649AAD13A4F4E07411{}
-1. Enter your client ID in the *ID* parameter field.
-2. Enter your client secret in the *Key* parameter field.
-3. Enter your tenant ID in the *Token* parameter field.
-4. Select the ***Use a self-deployed Azure Application*** checkbox in the integration instance configuration.
-5. Test and Save the instance.
-Alternatively, instead of providing the *Client Secret*, you can authenticate using [certificate credentials](https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-certificate-credentials) by providing:
- * Certificate Thumbprint - The certificate thumbprint as appears when registering the certificate to the App
- * Private Key - The private key of the registered certificate
+5. Then run:
+ cat MyXSOARApp.key
+
+You will get results such as:
+
+ -----BEGIN PRIVATE KEY-----
+ ff12gg4kilo2gftvy54.....
+ -----END PRIVATE KEY-----
+
+This is your private key, including the headrs:
+
+
+5. Next, go to Azure Portal → App registrations → Select your app → Certificates & secrets → Certificates
+
+Click “Upload certificate”.
+Select your public certificate, the file with the name MyXSOARApp.crt (not the .key file).
+
+Click Add.
+
+6. Paste the private key and the certificate thumbprint to the instance configuration in XSOAR and click on "Test".
### Authorization Code flow
From 00028908aa7027fafe699f00960e72891d8cada3 Mon Sep 17 00:00:00 2001
From: noydavidi <77931201+noydavidi@users.noreply.github.com>
Date: Wed, 15 Oct 2025 16:50:15 +0300
Subject: [PATCH 04/33] Update microsoft-auth-guide.md
---
.../extra-docs/articles/microsoft-auth-guide.md | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/content-repo/extra-docs/articles/microsoft-auth-guide.md b/content-repo/extra-docs/articles/microsoft-auth-guide.md
index 87b500afe..4b8933655 100644
--- a/content-repo/extra-docs/articles/microsoft-auth-guide.md
+++ b/content-repo/extra-docs/articles/microsoft-auth-guide.md
@@ -81,18 +81,22 @@ Alternatively, instead of providing the *Client Secret*, you can authenticate us
You can find more information about it in [Microsoft Documentations]((https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-certificate-credentials) or to follow the next steps in case of Linux system operation:
1. Run
+
openssl genrsa -out MyXSOARApp.key 2048
openssl req -new -x509 -key MyXSOARApp.key -out MyXSOARApp.crt -days 365 -subj "/CN=MyXSOARApp"
openssl x509 -in MyXSOARApp.crt -noout -fingerprint -sha1
-2. You will get results such as:
+3. You will get results such as:
+
sha1 Fingerprint=E4:64:9A:AD:13:A4:F4:E0:74:11
-3. Remove the colons, this is your certificate thumbprint. For example:
+4. Remove the colons, this is your certificate thumbprint. For example:
+
E4649AAD13A4F4E07411{}
5. Then run:
+
cat MyXSOARApp.key
You will get results such as:
@@ -101,7 +105,7 @@ You will get results such as:
ff12gg4kilo2gftvy54.....
-----END PRIVATE KEY-----
-This is your private key, including the headrs:
+This is your private key, include the headers.
5. Next, go to Azure Portal → App registrations → Select your app → Certificates & secrets → Certificates
From 3e9a558317a317b35c16c9811a08c5372d3417cd Mon Sep 17 00:00:00 2001
From: noydavidi <77931201+noydavidi@users.noreply.github.com>
Date: Wed, 15 Oct 2025 16:52:23 +0300
Subject: [PATCH 05/33] Update microsoft-auth-guide.md
---
.../extra-docs/articles/microsoft-auth-guide.md | 17 +++++++++--------
1 file changed, 9 insertions(+), 8 deletions(-)
diff --git a/content-repo/extra-docs/articles/microsoft-auth-guide.md b/content-repo/extra-docs/articles/microsoft-auth-guide.md
index 4b8933655..770e66970 100644
--- a/content-repo/extra-docs/articles/microsoft-auth-guide.md
+++ b/content-repo/extra-docs/articles/microsoft-auth-guide.md
@@ -79,25 +79,26 @@ Alternatively, instead of providing the *Client Secret*, you can authenticate us
* Certificate Thumbprint - The certificate thumbprint as appears when registering the certificate to the App
* Private Key - The private key of the registered certificate
- You can find more information about it in [Microsoft Documentations]((https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-certificate-credentials) or to follow the next steps in case of Linux system operation:
- 1. Run
+ You can find more information about it in [Microsoft Documentations](https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-certificate-credentials) or to follow the next steps in case of Linux system operation:
+ 1. Run
openssl genrsa -out MyXSOARApp.key 2048
+
openssl req -new -x509 -key MyXSOARApp.key -out MyXSOARApp.crt -days 365 -subj "/CN=MyXSOARApp"
+
openssl x509 -in MyXSOARApp.crt -noout -fingerprint -sha1
3. You will get results such as:
-
- sha1 Fingerprint=E4:64:9A:AD:13:A4:F4:E0:74:11
-4. Remove the colons, this is your certificate thumbprint. For example:
+ sha1 Fingerprint=E4:64:9A:AD:13:A4:F4:E0:74:11
+
+5. Remove the colons, this is your certificate thumbprint. For example:
E4649AAD13A4F4E07411{}
+6. Then run:
-5. Then run:
-
- cat MyXSOARApp.key
+ cat MyXSOARApp.key
You will get results such as:
From b21905fca5b1ecd6389c4af38d42afb9a21d162a Mon Sep 17 00:00:00 2001
From: noydavidi <77931201+noydavidi@users.noreply.github.com>
Date: Wed, 15 Oct 2025 16:54:02 +0300
Subject: [PATCH 06/33] Update microsoft-auth-guide.md
---
content-repo/extra-docs/articles/microsoft-auth-guide.md | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
diff --git a/content-repo/extra-docs/articles/microsoft-auth-guide.md b/content-repo/extra-docs/articles/microsoft-auth-guide.md
index 770e66970..b8a4ffb55 100644
--- a/content-repo/extra-docs/articles/microsoft-auth-guide.md
+++ b/content-repo/extra-docs/articles/microsoft-auth-guide.md
@@ -83,22 +83,20 @@ Alternatively, instead of providing the *Client Secret*, you can authenticate us
1. Run
openssl genrsa -out MyXSOARApp.key 2048
-
openssl req -new -x509 -key MyXSOARApp.key -out MyXSOARApp.crt -days 365 -subj "/CN=MyXSOARApp"
-
openssl x509 -in MyXSOARApp.crt -noout -fingerprint -sha1
3. You will get results such as:
- sha1 Fingerprint=E4:64:9A:AD:13:A4:F4:E0:74:11
+ ```sha1 Fingerprint=E4:64:9A:AD:13:A4:F4:E0:74:11```
5. Remove the colons, this is your certificate thumbprint. For example:
- E4649AAD13A4F4E07411{}
+ ```E4649AAD13A4F4E07411```
6. Then run:
- cat MyXSOARApp.key
+ ```cat MyXSOARApp.key```
You will get results such as:
From 8c4b43179da2cfe25ec87b8a2740fb603aad775b Mon Sep 17 00:00:00 2001
From: noydavidi <77931201+noydavidi@users.noreply.github.com>
Date: Wed, 15 Oct 2025 16:55:03 +0300
Subject: [PATCH 07/33] Update microsoft-auth-guide.md
---
.../extra-docs/articles/microsoft-auth-guide.md | 15 ++++++++-------
1 file changed, 8 insertions(+), 7 deletions(-)
diff --git a/content-repo/extra-docs/articles/microsoft-auth-guide.md b/content-repo/extra-docs/articles/microsoft-auth-guide.md
index b8a4ffb55..f25679c86 100644
--- a/content-repo/extra-docs/articles/microsoft-auth-guide.md
+++ b/content-repo/extra-docs/articles/microsoft-auth-guide.md
@@ -82,9 +82,11 @@ Alternatively, instead of providing the *Client Secret*, you can authenticate us
You can find more information about it in [Microsoft Documentations](https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-certificate-credentials) or to follow the next steps in case of Linux system operation:
1. Run
+ ```
openssl genrsa -out MyXSOARApp.key 2048
openssl req -new -x509 -key MyXSOARApp.key -out MyXSOARApp.crt -days 365 -subj "/CN=MyXSOARApp"
openssl x509 -in MyXSOARApp.crt -noout -fingerprint -sha1
+ ```
3. You will get results such as:
@@ -98,21 +100,20 @@ Alternatively, instead of providing the *Client Secret*, you can authenticate us
```cat MyXSOARApp.key```
-You will get results such as:
+ You will get results such as:
-----BEGIN PRIVATE KEY-----
ff12gg4kilo2gftvy54.....
-----END PRIVATE KEY-----
-This is your private key, include the headers.
-
+ This is your private key, include the headers.
5. Next, go to Azure Portal → App registrations → Select your app → Certificates & secrets → Certificates
-Click “Upload certificate”.
-Select your public certificate, the file with the name MyXSOARApp.crt (not the .key file).
-
-Click Add.
+ Click “Upload certificate”.
+ Select your public certificate, the file with the name MyXSOARApp.crt (not the .key file).
+
+ Click Add.
6. Paste the private key and the certificate thumbprint to the instance configuration in XSOAR and click on "Test".
From 258d88f72172fc60b734c83c035429cfd4921f11 Mon Sep 17 00:00:00 2001
From: noydavidi <77931201+noydavidi@users.noreply.github.com>
Date: Wed, 15 Oct 2025 16:56:47 +0300
Subject: [PATCH 08/33] Update microsoft-auth-guide.md
---
.../articles/microsoft-auth-guide.md | 18 +++++++++++++-----
1 file changed, 13 insertions(+), 5 deletions(-)
diff --git a/content-repo/extra-docs/articles/microsoft-auth-guide.md b/content-repo/extra-docs/articles/microsoft-auth-guide.md
index f25679c86..a206371a5 100644
--- a/content-repo/extra-docs/articles/microsoft-auth-guide.md
+++ b/content-repo/extra-docs/articles/microsoft-auth-guide.md
@@ -90,21 +90,29 @@ Alternatively, instead of providing the *Client Secret*, you can authenticate us
3. You will get results such as:
- ```sha1 Fingerprint=E4:64:9A:AD:13:A4:F4:E0:74:11```
+ ```
+ sha1 Fingerprint=E4:64:9A:AD:13:A4:F4:E0:74:11
+ ```
5. Remove the colons, this is your certificate thumbprint. For example:
- ```E4649AAD13A4F4E07411```
+ ```
+ E4649AAD13A4F4E07411
+ ```
-6. Then run:
+7. Then run:
- ```cat MyXSOARApp.key```
+ ```
+ cat MyXSOARApp.key
+ ```
You will get results such as:
-
+
+ ```
-----BEGIN PRIVATE KEY-----
ff12gg4kilo2gftvy54.....
-----END PRIVATE KEY-----
+ ```
This is your private key, include the headers.
From f5caf077fb0826f1f79885ce73efe0458579fdf1 Mon Sep 17 00:00:00 2001
From: noydavidi <77931201+noydavidi@users.noreply.github.com>
Date: Wed, 15 Oct 2025 16:58:26 +0300
Subject: [PATCH 09/33] Update microsoft-auth-guide.md
---
content-repo/extra-docs/articles/microsoft-auth-guide.md | 1 +
1 file changed, 1 insertion(+)
diff --git a/content-repo/extra-docs/articles/microsoft-auth-guide.md b/content-repo/extra-docs/articles/microsoft-auth-guide.md
index a206371a5..c0d830e1d 100644
--- a/content-repo/extra-docs/articles/microsoft-auth-guide.md
+++ b/content-repo/extra-docs/articles/microsoft-auth-guide.md
@@ -75,6 +75,7 @@ The Tenant ID, Client ID, and Client secret are required for the integration. Yo
7. In the instance configuration, select the ***Use a self-deployed Azure Application*** checkbox in the integration instance configuration.
8. Test and Save the instance.
+#### Certificate Thumbprint and Private Key
Alternatively, instead of providing the *Client Secret*, you can authenticate using certificate credentials by providing:
* Certificate Thumbprint - The certificate thumbprint as appears when registering the certificate to the App
* Private Key - The private key of the registered certificate
From f5efe402b07a960bf0bc1306b2ba049ae03b4408 Mon Sep 17 00:00:00 2001
From: noydavidi <77931201+noydavidi@users.noreply.github.com>
Date: Wed, 15 Oct 2025 17:01:12 +0300
Subject: [PATCH 10/33] Update microsoft-auth-guide.md
---
content-repo/extra-docs/articles/microsoft-auth-guide.md | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/content-repo/extra-docs/articles/microsoft-auth-guide.md b/content-repo/extra-docs/articles/microsoft-auth-guide.md
index c0d830e1d..76b9fb776 100644
--- a/content-repo/extra-docs/articles/microsoft-auth-guide.md
+++ b/content-repo/extra-docs/articles/microsoft-auth-guide.md
@@ -77,10 +77,11 @@ The Tenant ID, Client ID, and Client secret are required for the integration. Yo
#### Certificate Thumbprint and Private Key
Alternatively, instead of providing the *Client Secret*, you can authenticate using certificate credentials by providing:
- * Certificate Thumbprint - The certificate thumbprint as appears when registering the certificate to the App
- * Private Key - The private key of the registered certificate
- You can find more information about it in [Microsoft Documentations](https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-certificate-credentials) or to follow the next steps in case of Linux system operation:
+ - Certificate Thumbprint - The certificate thumbprint as appears when registering the certificate to the App
+ - Private Key - The private key of the registered certificate
+
+ You can find more information about it in [Microsoft Documentations](https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-certificate-credentials) or to follow the next steps in case of Mac/Linux operating systems:
1. Run
```
From 888b37b1cd1b1e1ce6e781ff6c5cc0d4100a5ef1 Mon Sep 17 00:00:00 2001
From: noydavidi <77931201+noydavidi@users.noreply.github.com>
Date: Wed, 15 Oct 2025 17:01:49 +0300
Subject: [PATCH 11/33] Update microsoft-auth-guide.md
---
content-repo/extra-docs/articles/microsoft-auth-guide.md | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/content-repo/extra-docs/articles/microsoft-auth-guide.md b/content-repo/extra-docs/articles/microsoft-auth-guide.md
index 76b9fb776..a00868d88 100644
--- a/content-repo/extra-docs/articles/microsoft-auth-guide.md
+++ b/content-repo/extra-docs/articles/microsoft-auth-guide.md
@@ -78,8 +78,8 @@ The Tenant ID, Client ID, and Client secret are required for the integration. Yo
#### Certificate Thumbprint and Private Key
Alternatively, instead of providing the *Client Secret*, you can authenticate using certificate credentials by providing:
- - Certificate Thumbprint - The certificate thumbprint as appears when registering the certificate to the App
- - Private Key - The private key of the registered certificate
+- Certificate Thumbprint - The certificate thumbprint as appears when registering the certificate to the App
+- Private Key - The private key of the registered certificate
You can find more information about it in [Microsoft Documentations](https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-certificate-credentials) or to follow the next steps in case of Mac/Linux operating systems:
1. Run
From 803a863f0e8abd65f0cd3330b2c46367a2fca3de Mon Sep 17 00:00:00 2001
From: noydavidi <77931201+noydavidi@users.noreply.github.com>
Date: Wed, 15 Oct 2025 17:04:22 +0300
Subject: [PATCH 12/33] Update microsoft-auth-guide.md
---
.../articles/microsoft-auth-guide.md | 19 ++++++++-----------
1 file changed, 8 insertions(+), 11 deletions(-)
diff --git a/content-repo/extra-docs/articles/microsoft-auth-guide.md b/content-repo/extra-docs/articles/microsoft-auth-guide.md
index a00868d88..2d2ca70eb 100644
--- a/content-repo/extra-docs/articles/microsoft-auth-guide.md
+++ b/content-repo/extra-docs/articles/microsoft-auth-guide.md
@@ -78,8 +78,8 @@ The Tenant ID, Client ID, and Client secret are required for the integration. Yo
#### Certificate Thumbprint and Private Key
Alternatively, instead of providing the *Client Secret*, you can authenticate using certificate credentials by providing:
-- Certificate Thumbprint - The certificate thumbprint as appears when registering the certificate to the App
-- Private Key - The private key of the registered certificate
+- **Certificate Thumbprint** - The certificate thumbprint as appears when registering the certificate to the App
+- **Private Key** - The private key of the registered certificate
You can find more information about it in [Microsoft Documentations](https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-certificate-credentials) or to follow the next steps in case of Mac/Linux operating systems:
1. Run
@@ -90,19 +90,19 @@ Alternatively, instead of providing the *Client Secret*, you can authenticate us
openssl x509 -in MyXSOARApp.crt -noout -fingerprint -sha1
```
-3. You will get results such as:
+2. You will get results such as:
```
sha1 Fingerprint=E4:64:9A:AD:13:A4:F4:E0:74:11
```
-5. Remove the colons, this is your certificate thumbprint. For example:
+3. Remove the colons, this is your certificate thumbprint. For example:
```
E4649AAD13A4F4E07411
```
-7. Then run:
+4. Next, run:
```
cat MyXSOARApp.key
@@ -118,14 +118,11 @@ Alternatively, instead of providing the *Client Secret*, you can authenticate us
This is your private key, include the headers.
-5. Next, go to Azure Portal → App registrations → Select your app → Certificates & secrets → Certificates
+5. Next, go to Azure Portal → App registrations → Select your app → Certificates & secrets → Certificates. Click “Upload certificate”.
- Click “Upload certificate”.
- Select your public certificate, the file with the name MyXSOARApp.crt (not the .key file).
-
- Click Add.
+6. Select your public certificate, the file with the name **MyXSOARApp.crt** (not the .key file). Click on "Add".
-6. Paste the private key and the certificate thumbprint to the instance configuration in XSOAR and click on "Test".
+7. Paste the private key and the certificate thumbprint to the instance configuration in XSOAR/XSIAM and click on "Test".
### Authorization Code flow
From fe61c57a9717fe827e5cb36da9c40eea5609fe93 Mon Sep 17 00:00:00 2001
From: noydavidi <77931201+noydavidi@users.noreply.github.com>
Date: Wed, 15 Oct 2025 17:29:14 +0300
Subject: [PATCH 13/33] Update microsoft-auth-guide.md
---
.../articles/microsoft-auth-guide.md | 39 +++++++++++--------
1 file changed, 22 insertions(+), 17 deletions(-)
diff --git a/content-repo/extra-docs/articles/microsoft-auth-guide.md b/content-repo/extra-docs/articles/microsoft-auth-guide.md
index 2d2ca70eb..4f36abe43 100644
--- a/content-repo/extra-docs/articles/microsoft-auth-guide.md
+++ b/content-repo/extra-docs/articles/microsoft-auth-guide.md
@@ -64,7 +64,10 @@ To add the registration, refer to the [Microsoft documentation](https://docs.mic
### Client Credentials Flow
Some Cortex XSOAR/XSIAM Microsoft integrations use the [client credentials flow](https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-client-creds-grant-flow).
-The Tenant ID, Client ID, and Client secret are required for the integration. You can get those values from the Azure Portal under the application information.
+When configured using this flow, the integration operates at the organization (tenant) level, allowing actions to be performed across the entire tenant. This flow typically uses application permissions, which must be defined in the Azure application configuration within the Azure Portal. These permissions determine that all XSOAR/XSIAM commands executed through this authentication method act within the organization or tenant scope.
+
+For this flow, the Tenant ID, Client ID, and Client secret are required for the integration. You can get those values from the Azure Portal under the application information.
+Follow these steps:
1. Enter the Azure Portal.
2. Search for you application using your application name or ID. You can search for it under the "App registrations" or to use the search bar.
@@ -126,20 +129,22 @@ Alternatively, instead of providing the *Client Secret*, you can authenticate us
### Authorization Code flow
-Some Cortex XSOAR-Microsoft integrations (e.g., Microsoft Graph Mail Single User) require authorization on behalf of a user (not admin consent). For more information about this authorization flow, refer to the [authorization code flow](https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow).
-
-To configure a Microsoft integration that uses this authorization flow with a self-deployed Azure application:
-
-1. Make sure the needed permissions are granted for the app registration, e.g., for Microsoft Graph User: API/Permission name `Directory.AccessAsUser.All` of type `Delegated`.
-2. In your app. click **Authentication** > **Platform configurations** > **Add a platform.** Choose **Web** and add [Redirect URI](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app#add-a-redirect-uri).
-The Redirect URI can direct any web application that you wish to receive responses from Azure AD. If you are not sure what to set, you can use `https://localhost`.
-3. Enter your client ID in the *ID* parameter field.
-4. Enter your client secret in the *Key* parameter field.
-5. Enter your tenant ID in the *Token* parameter field.
-6. Enter your redirect URI in the *Redirect URI* parameter field.
-7. Select the ***Use a self-deployed Azure Application*** checkbox in the integration instance configuration.
-8. Save the instance.
-9. Run the `!-generate-login-url` command in the War Room and follow the instructions:
+Some Cortex XSOAR/XSIAM Microsoft integrations (e.g., Microsoft Graph Mail Single User) require authorization on behalf of a user (not admin consent). For more information about this authorization flow, refer to the [authorization code flow](https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow).
+When configured using this flow, the integration operates under the user’s context, allowing actions based on the signed-in user’s permissions. This flow uses delegated permissions, which are defined in the Azure application configuration in the Azure Portal.
+The user who authenticates must have the same roles and permissions as those granted to the application. These permissions determine which actions the user can perform through XSOAR/XSIAM commands, according to their privileges within the organization or tenant.
+
+For this flow, the Tenant ID, Client ID, Client secret and Redirect URI are required for the integration. You can get those values from the Azure Portal under the application information.
+Follow these steps:
+
+1. In your app, click **Authentication** > **Platform configurations** > **Add a platform.** Choose **Web** and add [Redirect URI](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app#add-a-redirect-uri).
+The Redirect URI can direct any web application that you wish to receive responses from Azure AD. If you are not sure what to set, you can use `https://localhost`.
+2. Enter your redirect URI in the *Redirect URI* parameter field in the instance configuration in XSOAR/XSIAM.
+3. Go to "Overview" section. Copy the "Application (client) ID" and paste it under the App/Client ID parameter field in the instance configuration in XSOAR/XSIAM.
+4. Copy the "Directory (tenant) ID" and paste it under the Token/Tenant ID parameter field in the instance configuration in XSOAR/XSIAM.
+5. In the application cofiguration go to "Certificates & secrets" and click on "New client secret", click on "Add" and copy the secret **value**. Paste it under the Client Secret parameter field in the instance configuration in XSOAR/XSIAM.
+6. Select the ***Use a self-deployed Azure Application*** checkbox in the integration instance configuration.
+7. Save the instance.
+8. Run the `!-generate-login-url` command in the War Room and follow the instructions:
>1. Click on the [login URL]() to sign in and grant Cortex XSOAR permissions for your Azure Service Management.
You will be automatically redirected to a link with the following structure:
```REDIRECT_URI?code=AUTH_CODE&session_state=SESSION_STATE```
@@ -147,8 +152,8 @@ The Redirect URI can direct any web application that you wish to receive respons
and paste it in your instance configuration under the *Authorization code* parameter.
>3. For any issues, see [Authorization Code flow Troubleshooting](#authorization-code-flow-troubleshooting).
-10. Save the instance.
-11. Run the `!-auth-test` command. A 'Success' message should be printed to the War Room.
+9. Save the instance.
+10. Run the `!-auth-test` command. A 'Success' message should be printed to the War Room.
### Device Code Flow
Some Cortex XSOAR-Microsoft integrations use the [device code flow](https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-device-code).
From 9b3ec364897ca5f4b681f5c276f9268e614a2d90 Mon Sep 17 00:00:00 2001
From: noydavidi <77931201+noydavidi@users.noreply.github.com>
Date: Wed, 15 Oct 2025 21:43:02 +0300
Subject: [PATCH 14/33] Update microsoft-auth-guide.md
---
content-repo/extra-docs/articles/microsoft-auth-guide.md | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/content-repo/extra-docs/articles/microsoft-auth-guide.md b/content-repo/extra-docs/articles/microsoft-auth-guide.md
index 4f36abe43..dacca7b8d 100644
--- a/content-repo/extra-docs/articles/microsoft-auth-guide.md
+++ b/content-repo/extra-docs/articles/microsoft-auth-guide.md
@@ -12,7 +12,8 @@ More info at: [Device Code flow - Evolved phishing](https://www.microsoft.com/se
:::
-Microsoft's integrations (Graph and Azure) in Cortex XSOAR/XSIAM use Azure Active Directory applications to authenticate with Microsoft APIs. Those applications define the permissions and the roles for actions and XSOAR/XSIAM commands.
+Microsoft integrations (Graph and Azure) in Cortex XSOAR/XSIAM use Azure Active Directory (Azure AD) applications to securely authenticate with Microsoft APIs. These applications act as the bridge between XSOAR/XSIAM and Microsoft services, defining which API requests can be performed and what level of access is granted. The permissions and roles configured in the Azure application determine what data and actions the integration is authorized to access within your tenant.
+
Usually, you need to create your own application via Azure Portal and to set the API permissions, this is a self-deployed application. Alternatively, XSOAR/XSIAM suggests another solution where you can use the application XSOAR/XSIAM builds for you, this is the Cortex XSOAR application. In addition, for environments running within Azure, you can authenticate using Azure Managed Identities, which allow XSOAR/XSIAM to access Azure resources securely without managing credentials manually.
Therefore, there are three application authentication methods available:
From 3cc646f19c8f8fbaddb218aae54ed6ca88d8038e Mon Sep 17 00:00:00 2001
From: noydavidi <77931201+noydavidi@users.noreply.github.com>
Date: Thu, 16 Oct 2025 15:06:50 +0300
Subject: [PATCH 15/33] Update microsoft-auth-guide.md
device code section
---
.../articles/microsoft-auth-guide.md | 30 +++++++++++++------
1 file changed, 21 insertions(+), 9 deletions(-)
diff --git a/content-repo/extra-docs/articles/microsoft-auth-guide.md b/content-repo/extra-docs/articles/microsoft-auth-guide.md
index dacca7b8d..bdb5e5554 100644
--- a/content-repo/extra-docs/articles/microsoft-auth-guide.md
+++ b/content-repo/extra-docs/articles/microsoft-auth-guide.md
@@ -79,6 +79,8 @@ Follow these steps:
7. In the instance configuration, select the ***Use a self-deployed Azure Application*** checkbox in the integration instance configuration.
8. Test and Save the instance.
+**Note:** Make sure the neccessary permissions and roles are applied to the application.
+
#### Certificate Thumbprint and Private Key
Alternatively, instead of providing the *Client Secret*, you can authenticate using certificate credentials by providing:
@@ -156,22 +158,32 @@ The Redirect URI can direct any web application that you wish to receive respons
9. Save the instance.
10. Run the `!-auth-test` command. A 'Success' message should be printed to the War Room.
+**Note:** Make sure the neccessary permissions and roles are applied to the application and to the user.
+
### Device Code Flow
Some Cortex XSOAR-Microsoft integrations use the [device code flow](https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-device-code).
+When configured using this flow, the integration operates under the user’s context, similar to the Authorization Code Flow, but it is designed for devices or environments where a browser-based login is not available. This flow also uses delegated permissions, which must be defined in the Azure application configuration in the Azure Portal.
+The user authenticating via the device code must have the same roles and permissions as those granted to the application. These permissions determine which actions the user can perform through XSOAR/XSIAM commands within the organization or tenant scope.
-To configure a Microsoft integration that uses this authorization flow with a self-deployed Azure application:
+During authentication, the user will be provided with a code and a URL. They must enter the code at the URL using a browser on any device to complete the sign-in process.
-1. Make sure the needed permissions are granted for the app registration.
-2. The Redirect URI can direct any web application that you wish to receive responses from Azure AD. If you are not sure what to set, you can use `https://localhost`.
-3. In **Supported account types**, *Accounts in any organizational directory (Any Azure AD directory - Multi-tenant)* should be selected.
-4. In the app registration, navigate to **Authentication** > **Advanced Settings**, and enable the mobile and desktop flows.
+For this flow, the Tenant ID, Client ID, Client secret and Redirect URI are required for the integration. You can get those values from the Azure Portal under the application information.
+Follow these steps:
+
+1. In your app, click **Authentication** > **Platform configurations** > **Add a platform.** Choose **Web** and add [Redirect URI](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app#add-a-redirect-uri).
+The Redirect URI can direct any web application that you wish to receive responses from Azure AD. If you are not sure what to set, you can use `https://localhost`.
+2. Enter your redirect URI in the *Redirect URI* parameter field in the instance configuration in XSOAR/XSIAM.
+3. In the app registration, navigate to **Authentication**, under In **Supported account types**, *Accounts in any organizational directory (Any Azure AD directory - Multi-tenant)* should be selected. In the same page, under the **Advanced Settings** section, enable the mobile and desktop flows.
-5. Enter your application ID in the ***Application ID*** parameter field.
-6. Run the `!-auth-start` command - you will be prompted to open the page https://microsoft.com/devicelogin and enter the generated code.
-7. Run the `!-auth-complete` command.
-8. Run the `!-auth-test` command to ensure connectivity to Microsoft.
+4. Next, click on **Overview** and copy the "Application (client) ID" and paste it under the App/Client ID parameter field in the instance configuration in XSOAR/XSIAM.
+5. Click "Save and Exit".
+7. Run the `!-auth-start` command - you will be prompted to open the page https://microsoft.com/devicelogin and enter the generated code.
+8. Run the `!-auth-complete` command.
+9. Run the `!-auth-test` command to ensure connectivity to Microsoft.
+
+**Note:** Make sure the neccessary permissions and roles are applied to the application and to the user.
## Azure Managed Identities Authentication
#### Note: This option is relevant only if the integration is running on Azure VM.
From 222edccb0166dddeb0d111b0fd1e1b47f2cba438 Mon Sep 17 00:00:00 2001
From: noydavidi <77931201+noydavidi@users.noreply.github.com>
Date: Thu, 16 Oct 2025 15:22:02 +0300
Subject: [PATCH 16/33] Update microsoft-auth-guide.md
---
.../extra-docs/articles/microsoft-auth-guide.md | 15 +++++++--------
1 file changed, 7 insertions(+), 8 deletions(-)
diff --git a/content-repo/extra-docs/articles/microsoft-auth-guide.md b/content-repo/extra-docs/articles/microsoft-auth-guide.md
index bdb5e5554..69b187e8b 100644
--- a/content-repo/extra-docs/articles/microsoft-auth-guide.md
+++ b/content-repo/extra-docs/articles/microsoft-auth-guide.md
@@ -167,21 +167,20 @@ The user authenticating via the device code must have the same roles and permiss
During authentication, the user will be provided with a code and a URL. They must enter the code at the URL using a browser on any device to complete the sign-in process.
-For this flow, the Tenant ID, Client ID, Client secret and Redirect URI are required for the integration. You can get those values from the Azure Portal under the application information.
+For this flow, the Redirect URI is required for the integration. You can get those values from the Azure Portal under the application information.
Follow these steps:
1. In your app, click **Authentication** > **Platform configurations** > **Add a platform.** Choose **Web** and add [Redirect URI](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app#add-a-redirect-uri).
The Redirect URI can direct any web application that you wish to receive responses from Azure AD. If you are not sure what to set, you can use `https://localhost`.
-2. Enter your redirect URI in the *Redirect URI* parameter field in the instance configuration in XSOAR/XSIAM.
-3. In the app registration, navigate to **Authentication**, under In **Supported account types**, *Accounts in any organizational directory (Any Azure AD directory - Multi-tenant)* should be selected. In the same page, under the **Advanced Settings** section, enable the mobile and desktop flows.
+2. In the app registration, navigate to **Authentication**, under In **Supported account types**, *Accounts in any organizational directory (Any Azure AD directory - Multi-tenant)* should be selected. In the same page, under the **Advanced Settings** section, enable the mobile and desktop flows.
-4. Next, click on **Overview** and copy the "Application (client) ID" and paste it under the App/Client ID parameter field in the instance configuration in XSOAR/XSIAM.
-5. Click "Save and Exit".
-7. Run the `!-auth-start` command - you will be prompted to open the page https://microsoft.com/devicelogin and enter the generated code.
-8. Run the `!-auth-complete` command.
-9. Run the `!-auth-test` command to ensure connectivity to Microsoft.
+3. Next, click on **Overview** and copy the "Application (client) ID" and paste it under the App/Client ID parameter field in the instance configuration in XSOAR/XSIAM.
+4. Click "Save and Exit".
+5. Run the `!-auth-start` command - you will be prompted to open the page https://microsoft.com/devicelogin and enter the generated code.
+6. Run the `!-auth-complete` command.
+7. Run the `!-auth-test` command to ensure connectivity to Microsoft.
**Note:** Make sure the neccessary permissions and roles are applied to the application and to the user.
From ae36ee328b346abe86a1d60c37fabe6cf8971dca Mon Sep 17 00:00:00 2001
From: noydavidi <77931201+noydavidi@users.noreply.github.com>
Date: Thu, 16 Oct 2025 15:27:16 +0300
Subject: [PATCH 17/33] Update microsoft-auth-guide.md
reorder
---
.../articles/microsoft-auth-guide.md | 29 ++++++++++++++-----
1 file changed, 21 insertions(+), 8 deletions(-)
diff --git a/content-repo/extra-docs/articles/microsoft-auth-guide.md b/content-repo/extra-docs/articles/microsoft-auth-guide.md
index 69b187e8b..681f5109a 100644
--- a/content-repo/extra-docs/articles/microsoft-auth-guide.md
+++ b/content-repo/extra-docs/articles/microsoft-auth-guide.md
@@ -3,14 +3,16 @@ title: Microsoft Integrations - Authentication
description: Authentication method for Microsoft Graph and Azure integrations in Cortex XSOAR.
---
-:::info Security Awareness: Device Code Authorization
-It is recommended to use the client credentials and user authorization flows for integrations when possible. The device code authorization flow has limited protections against sophisticated phishing campaigns.
+This document includes the following sections to help you understand, set up, and use the integration effectively:
-In no scenario emails or other forms of communication will be sent to the customer asking to enter a security code or follow a link. All generated links and codes will be shown in the War Room, by running the official integration commands.
-
-More info at: [Device Code flow - Evolved phishing](https://www.microsoft.com/security/blog/2022/01/26/evolved-phishing-device-registration-trick-adds-to-phishers-toolbox-for-victims-without-mfa/)
-
-:::
+- [Integration Architecture](#integration-architecture)
+- [Setup and Configuration](#setup-and-configuration)
+- [Setup Examples](#setup-examples)
+- [Important Information](#important-information)
+- [Known Limitations](#known-limitations)
+- [Troubleshooting](#troubleshooting)
+- [Download Demisto Bot](#download-demisto-bot)
+- [Commands](#commands)
Microsoft integrations (Graph and Azure) in Cortex XSOAR/XSIAM use Azure Active Directory (Azure AD) applications to securely authenticate with Microsoft APIs. These applications act as the bridge between XSOAR/XSIAM and Microsoft services, defining which API requests can be performed and what level of access is granted. The permissions and roles configured in the Azure application determine what data and actions the integration is authorized to access within your tenant.
@@ -52,7 +54,7 @@ The application must have the required permissions and roles for the relevant AP
To add the registration, refer to the [Microsoft documentation](https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app)
-### Using National Cloud
+#### Using National Cloud
- To see which integrations support natively National Clouds,See the [table below.](https://xsoar.pan.dev/docs/reference/articles/microsoft-integrations---authentication#supported-authentication-flows-for-microsoft-integrations)
- For Microsoft Azure integrations, select the appropriate cloud using the *Azure Cloud* parameter.
@@ -63,6 +65,17 @@ To add the registration, refer to the [Microsoft documentation](https://docs.mic
authorization flow. For more information about Microsoft National Clouds, refer to the [Microsoft documentation](https://docs.microsoft.com/en-us/graph/deployments).
In order to use a national cloud, change the *Server URL* parameter to the corresponding address of the national cloud you are using.
+## Authentication Flows
+
+:::info Security Awareness: Device Code Authorization
+It is recommended to use the client credentials and user authorization flows for integrations when possible. The device code authorization flow has limited protections against sophisticated phishing campaigns.
+
+In no scenario emails or other forms of communication will be sent to the customer asking to enter a security code or follow a link. All generated links and codes will be shown in the War Room, by running the official integration commands.
+
+More info at: [Device Code flow - Evolved phishing](https://www.microsoft.com/security/blog/2022/01/26/evolved-phishing-device-registration-trick-adds-to-phishers-toolbox-for-victims-without-mfa/)
+
+:::
+
### Client Credentials Flow
Some Cortex XSOAR/XSIAM Microsoft integrations use the [client credentials flow](https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-client-creds-grant-flow).
When configured using this flow, the integration operates at the organization (tenant) level, allowing actions to be performed across the entire tenant. This flow typically uses application permissions, which must be defined in the Azure application configuration within the Azure Portal. These permissions determine that all XSOAR/XSIAM commands executed through this authentication method act within the organization or tenant scope.
From 5df7ac1006561f026dee0d03c890f9f830865ad2 Mon Sep 17 00:00:00 2001
From: noydavidi <77931201+noydavidi@users.noreply.github.com>
Date: Thu, 16 Oct 2025 15:33:37 +0300
Subject: [PATCH 18/33] Update microsoft-auth-guide.md
---
.../articles/microsoft-auth-guide.md | 138 +++++++++---------
1 file changed, 68 insertions(+), 70 deletions(-)
diff --git a/content-repo/extra-docs/articles/microsoft-auth-guide.md b/content-repo/extra-docs/articles/microsoft-auth-guide.md
index 681f5109a..5d31a8535 100644
--- a/content-repo/extra-docs/articles/microsoft-auth-guide.md
+++ b/content-repo/extra-docs/articles/microsoft-auth-guide.md
@@ -5,14 +5,12 @@ description: Authentication method for Microsoft Graph and Azure integrations in
This document includes the following sections to help you understand, set up, and use the integration effectively:
-- [Integration Architecture](#integration-architecture)
-- [Setup and Configuration](#setup-and-configuration)
-- [Setup Examples](#setup-examples)
-- [Important Information](#important-information)
-- [Known Limitations](#known-limitations)
-- [Troubleshooting](#troubleshooting)
-- [Download Demisto Bot](#download-demisto-bot)
-- [Commands](#commands)
+- [Cortex XSOAR Application](#cortex-xsoar-application)
+- [Self Deployed Application](#self-deployed-application)
+- [Using National Cloud](#using-national-cloud)
+- [Authentication Flows](#authentication-flows)
+- [Azure Managed Identities Authentication](#azure-managed-identities-authentication)
+- [How to find Azure Integrations Parameters](#how-to-find-azure-integrations-parameters)
Microsoft integrations (Graph and Azure) in Cortex XSOAR/XSIAM use Azure Active Directory (Azure AD) applications to securely authenticate with Microsoft APIs. These applications act as the bridge between XSOAR/XSIAM and Microsoft services, defining which API requests can be performed and what level of access is granted. The permissions and roles configured in the Azure application determine what data and actions the integration is authorized to access within your tenant.
@@ -173,68 +171,7 @@ The Redirect URI can direct any web application that you wish to receive respons
**Note:** Make sure the neccessary permissions and roles are applied to the application and to the user.
-### Device Code Flow
-Some Cortex XSOAR-Microsoft integrations use the [device code flow](https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-device-code).
-When configured using this flow, the integration operates under the user’s context, similar to the Authorization Code Flow, but it is designed for devices or environments where a browser-based login is not available. This flow also uses delegated permissions, which must be defined in the Azure application configuration in the Azure Portal.
-The user authenticating via the device code must have the same roles and permissions as those granted to the application. These permissions determine which actions the user can perform through XSOAR/XSIAM commands within the organization or tenant scope.
-
-During authentication, the user will be provided with a code and a URL. They must enter the code at the URL using a browser on any device to complete the sign-in process.
-
-For this flow, the Redirect URI is required for the integration. You can get those values from the Azure Portal under the application information.
-Follow these steps:
-
-1. In your app, click **Authentication** > **Platform configurations** > **Add a platform.** Choose **Web** and add [Redirect URI](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app#add-a-redirect-uri).
-The Redirect URI can direct any web application that you wish to receive responses from Azure AD. If you are not sure what to set, you can use `https://localhost`.
-2. In the app registration, navigate to **Authentication**, under In **Supported account types**, *Accounts in any organizational directory (Any Azure AD directory - Multi-tenant)* should be selected. In the same page, under the **Advanced Settings** section, enable the mobile and desktop flows.
-
-
-
-3. Next, click on **Overview** and copy the "Application (client) ID" and paste it under the App/Client ID parameter field in the instance configuration in XSOAR/XSIAM.
-4. Click "Save and Exit".
-5. Run the `!-auth-start` command - you will be prompted to open the page https://microsoft.com/devicelogin and enter the generated code.
-6. Run the `!-auth-complete` command.
-7. Run the `!-auth-test` command to ensure connectivity to Microsoft.
-
-**Note:** Make sure the neccessary permissions and roles are applied to the application and to the user.
-
-## Azure Managed Identities Authentication
-#### Note: This option is relevant only if the integration is running on Azure VM.
-
-Some of the Cortex XSOAR-Microsoft integrations use the [Azure Managed Identities Authentication](https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview).
-
-Follow one of these steps for authentication based on Azure Managed Identities:
-
-- ##### To use System Assigned Managed Identity
- - Select **Azure Managed Identities** from the **Authentication Type** drop down or select the **Use Azure Managed Identities** checkbox and leave the **Azure Managed Identities Client ID** field empty.
-
-- ##### To use User Assigned Managed Identity
- 1. Go to [Azure Portal](https://portal.azure.com/) -> **Managed Identities**.
- 2. Select your User Assigned Managed Identity -> copy the Client ID -> paste it in the **Azure Managed Identities Client ID** field in the instance settings.
- 3. Select **Azure Managed Identities** from the **Authentication Type** drop down or select the **Use Azure Managed Identities** checkbox.
-
-## Revoke Consent
-
-In order to revoke consent to a Cortex XSOAR Microsoft application, refer to the [Microsoft documentation](https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-convert-app-to-be-multi-tenant#revoking-consent).
-
-## Azure Integrations Parameters
-In order to use the Cortex XSOAR Azure application, you need to fill in your subscription ID and resource group name, which you can find in the Azure Portal.
-
-1. Log in to the [Azure Portal Home Page](https://portal.azure.com/#home) using your Azure credentials.
-
-2. Search for your Azure product, for example SQL Servers:
-
- 
-
-3. Click on your resource:
-
- 
-
-After you a redirected to the next page, in the **Overview** tab you will find your Resource group and Subscription ID:
-
-
-
-
-## Self Deployed Application - Example for [Microsoft Graph User integration](https://xsoar.pan.dev/docs/reference/integrations/microsoft-graph-user)
+#### Example for [Microsoft Graph User integration](https://xsoar.pan.dev/docs/reference/integrations/microsoft-graph-user) configuration using a self-deployed and authorization code flow
1. In Microsoft Azure portal, create a new app registration.
1. Select Azure Active Directory> App registrations> New registration.
@@ -298,6 +235,67 @@ After you a redirected to the next page, in the **Overview** tab you will find y
7. Save the integration settings and test the setup by running the *!msgraph-user-test* command from the Cortex XSOAR CLI.
+### Device Code Flow
+Some Cortex XSOAR-Microsoft integrations use the [device code flow](https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-device-code).
+When configured using this flow, the integration operates under the user’s context, similar to the Authorization Code Flow, but it is designed for devices or environments where a browser-based login is not available. This flow also uses delegated permissions, which must be defined in the Azure application configuration in the Azure Portal.
+The user authenticating via the device code must have the same roles and permissions as those granted to the application. These permissions determine which actions the user can perform through XSOAR/XSIAM commands within the organization or tenant scope.
+
+During authentication, the user will be provided with a code and a URL. They must enter the code at the URL using a browser on any device to complete the sign-in process.
+
+For this flow, the Redirect URI is required for the integration. You can get those values from the Azure Portal under the application information.
+Follow these steps:
+
+1. In your app, click **Authentication** > **Platform configurations** > **Add a platform.** Choose **Web** and add [Redirect URI](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-register-app#add-a-redirect-uri).
+The Redirect URI can direct any web application that you wish to receive responses from Azure AD. If you are not sure what to set, you can use `https://localhost`.
+2. In the app registration, navigate to **Authentication**, under In **Supported account types**, *Accounts in any organizational directory (Any Azure AD directory - Multi-tenant)* should be selected. In the same page, under the **Advanced Settings** section, enable the mobile and desktop flows.
+
+
+
+3. Next, click on **Overview** and copy the "Application (client) ID" and paste it under the App/Client ID parameter field in the instance configuration in XSOAR/XSIAM.
+4. Click "Save and Exit".
+5. Run the `!-auth-start` command - you will be prompted to open the page https://microsoft.com/devicelogin and enter the generated code.
+6. Run the `!-auth-complete` command.
+7. Run the `!-auth-test` command to ensure connectivity to Microsoft.
+
+**Note:** Make sure the neccessary permissions and roles are applied to the application and to the user.
+
+## Azure Managed Identities Authentication
+#### Note: This option is relevant only if the integration is running on Azure VM.
+
+Some of the Cortex XSOAR-Microsoft integrations use the [Azure Managed Identities Authentication](https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview).
+
+Follow one of these steps for authentication based on Azure Managed Identities:
+
+- ##### To use System Assigned Managed Identity
+ - Select **Azure Managed Identities** from the **Authentication Type** drop down or select the **Use Azure Managed Identities** checkbox and leave the **Azure Managed Identities Client ID** field empty.
+
+- ##### To use User Assigned Managed Identity
+ 1. Go to [Azure Portal](https://portal.azure.com/) -> **Managed Identities**.
+ 2. Select your User Assigned Managed Identity -> copy the Client ID -> paste it in the **Azure Managed Identities Client ID** field in the instance settings.
+ 3. Select **Azure Managed Identities** from the **Authentication Type** drop down or select the **Use Azure Managed Identities** checkbox.
+
+## Revoke Consent
+
+In order to revoke consent to a Cortex XSOAR Microsoft application, refer to the [Microsoft documentation](https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-convert-app-to-be-multi-tenant#revoking-consent).
+
+## How to find Azure Integrations Parameters
+In order to use the Cortex XSOAR/XSIAM Azure application, you need to fill in your subscription ID and resource group name, which you can find in the Azure Portal.
+
+1. Log in to the [Azure Portal Home Page](https://portal.azure.com/#home) using your Azure credentials.
+
+2. Search for your Azure product, for example SQL Servers:
+
+ 
+
+3. Click on your resource:
+
+ 
+
+After you a redirected to the next page, in the **Overview** tab you will find your Resource group and Subscription ID:
+
+
+
+
## Supported Authentication Flows for Microsoft integrations
| Integration Name | XSOAR Application | Client Credentials | Device Code | Auth code (redirect URI) | Azure Managed Identities | Supports National Clouds |
From 5b5e6136d1a09cf632ded018df8d366826957a07 Mon Sep 17 00:00:00 2001
From: noydavidi <77931201+noydavidi@users.noreply.github.com>
Date: Thu, 16 Oct 2025 15:37:05 +0300
Subject: [PATCH 19/33] Update microsoft-auth-guide.md
---
.../articles/microsoft-auth-guide.md | 32 ++++++++++---------
1 file changed, 17 insertions(+), 15 deletions(-)
diff --git a/content-repo/extra-docs/articles/microsoft-auth-guide.md b/content-repo/extra-docs/articles/microsoft-auth-guide.md
index 5d31a8535..bf089ee96 100644
--- a/content-repo/extra-docs/articles/microsoft-auth-guide.md
+++ b/content-repo/extra-docs/articles/microsoft-auth-guide.md
@@ -11,6 +11,7 @@ This document includes the following sections to help you understand, set up, an
- [Authentication Flows](#authentication-flows)
- [Azure Managed Identities Authentication](#azure-managed-identities-authentication)
- [How to find Azure Integrations Parameters](#how-to-find-azure-integrations-parameters)
+- [Troubleshooting](#troubleshooting)
Microsoft integrations (Graph and Azure) in Cortex XSOAR/XSIAM use Azure Active Directory (Azure AD) applications to securely authenticate with Microsoft APIs. These applications act as the bridge between XSOAR/XSIAM and Microsoft services, defining which API requests can be performed and what level of access is granted. The permissions and roles configured in the Azure application determine what data and actions the integration is authorized to access within your tenant.
@@ -24,7 +25,7 @@ Therefore, there are three application authentication methods available:
You must use one of those authentication methods.
-## Cortex XSOAR Application
+# Cortex XSOAR Application
In this method, you grant consent for the Cortex XSOAR multi-tenant application to access your data. The application is maintained by Cortex XSOAR.
Depending on the integration, this requires either admin consent to [get access without a user](https://docs.microsoft.com/en-us/graph/auth-v2-service) or user consent to [get access on behalf of a user](https://docs.microsoft.com/en-us/graph/auth-v2-user).
@@ -44,7 +45,7 @@ To start the authentication process, go to the integration's detailed instructio
Click on "Test". The instance should be configured successfully.
-## Self Deployed Application
+# Self Deployed Application
To use a self-configured Azure application, you need to add a new Azure App Registration in the Azure Portal.
@@ -52,7 +53,7 @@ The application must have the required permissions and roles for the relevant AP
To add the registration, refer to the [Microsoft documentation](https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app)
-#### Using National Cloud
+### Using National Cloud
- To see which integrations support natively National Clouds,See the [table below.](https://xsoar.pan.dev/docs/reference/articles/microsoft-integrations---authentication#supported-authentication-flows-for-microsoft-integrations)
- For Microsoft Azure integrations, select the appropriate cloud using the *Azure Cloud* parameter.
@@ -63,7 +64,7 @@ To add the registration, refer to the [Microsoft documentation](https://docs.mic
authorization flow. For more information about Microsoft National Clouds, refer to the [Microsoft documentation](https://docs.microsoft.com/en-us/graph/deployments).
In order to use a national cloud, change the *Server URL* parameter to the corresponding address of the national cloud you are using.
-## Authentication Flows
+# Authentication Flows
:::info Security Awareness: Device Code Authorization
It is recommended to use the client credentials and user authorization flows for integrations when possible. The device code authorization flow has limited protections against sophisticated phishing campaigns.
@@ -74,7 +75,7 @@ More info at: [Device Code flow - Evolved phishing](https://www.microsoft.com/se
:::
-### Client Credentials Flow
+## Client Credentials Flow
Some Cortex XSOAR/XSIAM Microsoft integrations use the [client credentials flow](https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-client-creds-grant-flow).
When configured using this flow, the integration operates at the organization (tenant) level, allowing actions to be performed across the entire tenant. This flow typically uses application permissions, which must be defined in the Azure application configuration within the Azure Portal. These permissions determine that all XSOAR/XSIAM commands executed through this authentication method act within the organization or tenant scope.
@@ -92,7 +93,7 @@ Follow these steps:
**Note:** Make sure the neccessary permissions and roles are applied to the application.
-#### Certificate Thumbprint and Private Key
+### Certificate Thumbprint and Private Key
Alternatively, instead of providing the *Client Secret*, you can authenticate using certificate credentials by providing:
- **Certificate Thumbprint** - The certificate thumbprint as appears when registering the certificate to the App
@@ -142,7 +143,7 @@ Alternatively, instead of providing the *Client Secret*, you can authenticate us
7. Paste the private key and the certificate thumbprint to the instance configuration in XSOAR/XSIAM and click on "Test".
-### Authorization Code flow
+## Authorization Code flow
Some Cortex XSOAR/XSIAM Microsoft integrations (e.g., Microsoft Graph Mail Single User) require authorization on behalf of a user (not admin consent). For more information about this authorization flow, refer to the [authorization code flow](https://learn.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-auth-code-flow).
When configured using this flow, the integration operates under the user’s context, allowing actions based on the signed-in user’s permissions. This flow uses delegated permissions, which are defined in the Azure application configuration in the Azure Portal.
The user who authenticates must have the same roles and permissions as those granted to the application. These permissions determine which actions the user can perform through XSOAR/XSIAM commands, according to their privileges within the organization or tenant.
@@ -171,12 +172,13 @@ The Redirect URI can direct any web application that you wish to receive respons
**Note:** Make sure the neccessary permissions and roles are applied to the application and to the user.
-#### Example for [Microsoft Graph User integration](https://xsoar.pan.dev/docs/reference/integrations/microsoft-graph-user) configuration using a self-deployed and authorization code flow
+### Example for [Microsoft Graph User integration](https://xsoar.pan.dev/docs/reference/integrations/microsoft-graph-user) configuration using a self-deployed and authorization code flow
1. In Microsoft Azure portal, create a new app registration.
1. Select Azure Active Directory> App registrations> New registration.
- 
+ 
+
2. In the **Redirect URI (optional)** field select **Web** and type a name (you can enter an arbitrary name). In this example we use *https://xsoar.*
@@ -235,7 +237,7 @@ The Redirect URI can direct any web application that you wish to receive respons
7. Save the integration settings and test the setup by running the *!msgraph-user-test* command from the Cortex XSOAR CLI.
-### Device Code Flow
+## Device Code Flow
Some Cortex XSOAR-Microsoft integrations use the [device code flow](https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-oauth2-device-code).
When configured using this flow, the integration operates under the user’s context, similar to the Authorization Code Flow, but it is designed for devices or environments where a browser-based login is not available. This flow also uses delegated permissions, which must be defined in the Azure application configuration in the Azure Portal.
The user authenticating via the device code must have the same roles and permissions as those granted to the application. These permissions determine which actions the user can perform through XSOAR/XSIAM commands within the organization or tenant scope.
@@ -259,7 +261,7 @@ The Redirect URI can direct any web application that you wish to receive respons
**Note:** Make sure the neccessary permissions and roles are applied to the application and to the user.
-## Azure Managed Identities Authentication
+# Azure Managed Identities Authentication
#### Note: This option is relevant only if the integration is running on Azure VM.
Some of the Cortex XSOAR-Microsoft integrations use the [Azure Managed Identities Authentication](https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview).
@@ -274,11 +276,11 @@ Follow one of these steps for authentication based on Azure Managed Identities:
2. Select your User Assigned Managed Identity -> copy the Client ID -> paste it in the **Azure Managed Identities Client ID** field in the instance settings.
3. Select **Azure Managed Identities** from the **Authentication Type** drop down or select the **Use Azure Managed Identities** checkbox.
-## Revoke Consent
+# Revoke Consent
In order to revoke consent to a Cortex XSOAR Microsoft application, refer to the [Microsoft documentation](https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-convert-app-to-be-multi-tenant#revoking-consent).
-## How to find Azure Integrations Parameters
+# How to find Azure Integrations Parameters
In order to use the Cortex XSOAR/XSIAM Azure application, you need to fill in your subscription ID and resource group name, which you can find in the Azure Portal.
1. Log in to the [Azure Portal Home Page](https://portal.azure.com/#home) using your Azure credentials.
@@ -296,7 +298,7 @@ After you a redirected to the next page, in the **Overview** tab you will find y
-## Supported Authentication Flows for Microsoft integrations
+# Supported Authentication Flows for Microsoft integrations
| Integration Name | XSOAR Application | Client Credentials | Device Code | Auth code (redirect URI) | Azure Managed Identities | Supports National Clouds |
|-------------------------------------------------------|-------------------|--------------------|-------------|--------------------------|--------------------------|--------------------------|
@@ -340,7 +342,7 @@ After you a redirected to the next page, in the **Overview** tab you will find y
-## Troubleshooting
+# Troubleshooting
#### Reset authentication
In case of errors in the authentication process, such as a token revoked/expired or in case you generate new credentials,
you can use the `!-auth-reset` command in the War Room in order to rerun the authentication process,
From b0a6cec20289fe0f4ae4e03c02358dc17020a931 Mon Sep 17 00:00:00 2001
From: noydavidi <77931201+noydavidi@users.noreply.github.com>
Date: Thu, 16 Oct 2025 15:55:38 +0300
Subject: [PATCH 20/33] Update microsoft-auth-guide.md
---
.../articles/microsoft-auth-guide.md | 70 +++++++------------
1 file changed, 25 insertions(+), 45 deletions(-)
diff --git a/content-repo/extra-docs/articles/microsoft-auth-guide.md b/content-repo/extra-docs/articles/microsoft-auth-guide.md
index bf089ee96..5b5440e9a 100644
--- a/content-repo/extra-docs/articles/microsoft-auth-guide.md
+++ b/content-repo/extra-docs/articles/microsoft-auth-guide.md
@@ -163,7 +163,7 @@ The Redirect URI can direct any web application that you wish to receive respons
>1. Click on the [login URL]() to sign in and grant Cortex XSOAR permissions for your Azure Service Management.
You will be automatically redirected to a link with the following structure:
```REDIRECT_URI?code=AUTH_CODE&session_state=SESSION_STATE```
- >2. Copy the `AUTH_CODE` (without the `code=` prefix, and the `session_state` parameter)
+ >2. Copy the `AUTH_CODE` (between the `code=` prefix and the `session_state` prefix)
and paste it in your instance configuration under the *Authorization code* parameter.
>3. For any issues, see [Authorization Code flow Troubleshooting](#authorization-code-flow-troubleshooting).
@@ -175,66 +175,46 @@ The Redirect URI can direct any web application that you wish to receive respons
### Example for [Microsoft Graph User integration](https://xsoar.pan.dev/docs/reference/integrations/microsoft-graph-user) configuration using a self-deployed and authorization code flow
1. In Microsoft Azure portal, create a new app registration.
- 1. Select Azure Active Directory> App registrations> New registration.
+ 1. Select **App registrations** -> **New registration**.
2. In the **Redirect URI (optional)** field select **Web** and type a name (you can enter an arbitrary name). In this example we use *https://xsoar.*
- 
+ 
+
3. Click **Register**.
- You can see the Essential information here:
-
- 
- 4. Copy the following information:
+ You can see the Essential information here:
+
+ 
+ 5. Copy the following information that apear under the "Overview" section:
- Application (client) ID
- Directory (tenant) ID
-2. Get the client secret, which is used for the **key** in the integration settings.
- 1. Click **Certificate and secrets** -> **New client secret**.
-
- Copy the client secret.
-3. Ensure the needed permissions are granted for the app registration.
- 1. Go to API permissions>Add a permission>Microsoft Graph>Delegated permissions and search for
- `Directory.AccessAsUser.All` of type `Delegated`.
- 2. Click Add permissions.
-
- 
-
- NOTE: Ensure that you have the following permissions:
+3. Go to **API permissions** -> Add a permission -> Microsoft Graph -> Delegated permission. Search for `Directory.AccessAsUser.All`.
+4. Click Add permissions.
+
+ 
+5. Repeat step 3 for the following permissions:
- Directory.Read.All - Delegated
- User.ReadWrite.All - Application
- User.Read - Delegated
-4. Get the authorization code.
-
- 1. Type the following in a browser: `https://login.microsoftonline.com//oauth2/v2.0/authorize?response_type=code&scope=offline_access%20directory.accessasuser.all&client_id=**&redirect_uri=https%3A%2F%2Fxsoar`
-
- Replace `tenant_id` and `client-id` with the tenant ID that was generated in step 1.iv.
-
- The URI is the *https://xsoar*.
-
- This prompts the admin user to sign in and grant the app the appropriate permissions:
-
- 
-
- Once completed you are redirected to the redirect URI and will receive an authorization code in the query parameters of the URI.
-
- **NOTE:** If there are multiple query parameters returned you should just copy the code value.
-
- 
+6. Next, create a new instance for the integration.
+7. Enter your redirect URI in the *Redirect URI* parameter field in the instance configuration in XSOAR/XSIAM.
+3. Paste the "Application (client) ID" under the App/Client ID parameter field in the instance configuration in XSOAR/XSIAM.
+4. Paste "Directory (tenant) ID" under the Token/Tenant ID parameter field in the instance configuration in XSOAR/XSIAM.
+5. In the application cofiguration go to "Certificates & secrets" and click on "New client secret", click on "Add" and copy the secret **value**. Paste it under the Client Secret parameter field in the instance configuration in XSOAR/XSIAM.
+6. Click the **Use a self-deployed Azure application** checkbox.
+7. Click on Save and Exit.
+8. Get the authorization code by following the next steps:
- 2. Copy the ***AUTH_CODE*** (without the "code=" prefix). This value must be used in the MS Graph User in Cortex XSOAR integration in the **Authorization Code** field.
-5. Add the information to the instance in Cortex XSOAR by going to Settings>Integrations>Microsoft Graph User>Add Instance.
+ 1. Run the msgraph-user-generate-login-url command in order to generate the url and follow the instructions.
+ 2. Copy the `AUTH_CODE` (between the `code=` prefix and the `session_state` prefix). This value need to be used in instance configuration under the **Authorization Code** field.
- 1. In the **ID** parameter field, type the client ID.
- 2. in the **Token** parameter field, type the tenant ID.
- 3. In the **Key** parameter field, type your client secret.
- 4. Click the **Use a self-deployed Azure application** checkbox.
- 5. In the **Redirect URI** field, type the redirect URI we are entering at the Azure portal.
- 6. In the **Authorization code for self-deployed mode - received from the authorization step**, type the code that was generated in 4.2.
- 7. Save the integration settings and test the setup by running the *!msgraph-user-test* command from the Cortex XSOAR CLI.
+9. Under the **Authorization code (for Self Deployed - Authorization Code Flow)**, field in the instance configuration, paste the code from the previous step.
+10. Save the instance and test the setup by running the *!msgraph-user-test* command from the Cortex XSOAR/XSIAM CLI.
## Device Code Flow
From b4b9a8f6bb6102982adf2c1305fc2798179c1b92 Mon Sep 17 00:00:00 2001
From: noydavidi <77931201+noydavidi@users.noreply.github.com>
Date: Sun, 19 Oct 2025 14:28:31 +0300
Subject: [PATCH 21/33] Update microsoft-auth-guide.md
---
.../extra-docs/articles/microsoft-auth-guide.md | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/content-repo/extra-docs/articles/microsoft-auth-guide.md b/content-repo/extra-docs/articles/microsoft-auth-guide.md
index 5b5440e9a..80cf19f52 100644
--- a/content-repo/extra-docs/articles/microsoft-auth-guide.md
+++ b/content-repo/extra-docs/articles/microsoft-auth-guide.md
@@ -53,6 +53,8 @@ The application must have the required permissions and roles for the relevant AP
To add the registration, refer to the [Microsoft documentation](https://docs.microsoft.com/en-us/azure/active-directory/develop/quickstart-register-app)
+**Note:** When adding a new permission to the application, you must run the !-auth-reset command. In case you are using device code flow or authorization code flow, you must also reconnect and create a new authorization code. After that, the new token used in the integration, will now contain the new permission.
+
### Using National Cloud
- To see which integrations support natively National Clouds,See the [table below.](https://xsoar.pan.dev/docs/reference/articles/microsoft-integrations---authentication#supported-authentication-flows-for-microsoft-integrations)
@@ -172,7 +174,7 @@ The Redirect URI can direct any web application that you wish to receive respons
**Note:** Make sure the neccessary permissions and roles are applied to the application and to the user.
-### Example for [Microsoft Graph User integration](https://xsoar.pan.dev/docs/reference/integrations/microsoft-graph-user) configuration using a self-deployed and authorization code flow
+### Example for configuring [Microsoft Graph User integration](https://xsoar.pan.dev/docs/reference/integrations/microsoft-graph-user) using a self-deployed and authorization code flow
1. In Microsoft Azure portal, create a new app registration.
1. Select **App registrations** -> **New registration**.
@@ -321,8 +323,11 @@ After you a redirected to the next page, in the **Overview** tab you will find y
| Microsoft Teams Management | yes | yes | yes | no | yes | no |
-
# Troubleshooting
+1. If you encounter any issues while configuring your self-deployed application, please ensure that the 'self-deploy' checkbox is selected.
+2. If you have added permissions to your self-deployed application but still encounter a permission error, make sure to run the !-auth-reset command. If you are using device code flow or authorization code flow, you must also reconnect and generate a new authorization code. After this, the new token used by the integration will include the updated permissions.
+3. If you expect command results at the organization or tenant level but are receiving results at the user level, ensure that your permissions are set as application permissions and that you are using the client credentials flow.
+
#### Reset authentication
In case of errors in the authentication process, such as a token revoked/expired or in case you generate new credentials,
you can use the `!-auth-reset` command in the War Room in order to rerun the authentication process,
@@ -341,3 +346,5 @@ For example, when using the "self-deployed Azure app" for Microsoft Graph Mail S
If you encounter issues with the User consent, such as a "Missing scope permissions on the request. API requires one of..." error after generating a new authorization code using the generate-login-url command, even though you have provided all the mentioned permissions, it may indicate that you need to trigger the consent process again.
To do this, copy the login URL, add `&prompt=consent` to the end of the URL, and then log in.
For details, see Microsoft's documentation on [Request an authorization code](https://learn.microsoft.com/en-us/entra/identity-platform/v2-oauth2-auth-code-flow#request-an-authorization-code).
+
+
From 09357056e05a2c75bad5c9776dc9cda8e7d9cb36 Mon Sep 17 00:00:00 2001
From: noydavidi
Date: Tue, 21 Oct 2025 13:04:06 +0300
Subject: [PATCH 22/33] added a new png
---
.../delegated_vs_delegated_permissions.png | Bin 0 -> 67702 bytes
1 file changed, 0 insertions(+), 0 deletions(-)
create mode 100644 docs/doc_imgs/tutorials/tut-microsoft-auth-guide/delegated_vs_delegated_permissions.png
diff --git a/docs/doc_imgs/tutorials/tut-microsoft-auth-guide/delegated_vs_delegated_permissions.png b/docs/doc_imgs/tutorials/tut-microsoft-auth-guide/delegated_vs_delegated_permissions.png
new file mode 100644
index 0000000000000000000000000000000000000000..78785cebfae36ce8794ed729e6a81244486acb4a
GIT binary patch
literal 67702
zcmd?RbySqy8vr0E=4+51%lO36!2Yz34eyr~X0@2aT!0AKv74=6B8)g97QUKljCYB%=1C``_d-XDzR~mbBk=m_1CJr$5A2gy*hok(J|sEk
znh~t}b3jnq?{GW+z%V%_Wzh%fsk4p8VLWu8U?>!-v7ph6KRo^lf#Gr+04PBqDgmqa
zE}_YGr7tgB`ZjCPareyWtc(W*^H|d{LyIZlr`$q`UfDpG@X*Rc{mo=1Q5C`@C^*_!
zo|=+~@XrUhZ!uu_m}k>w8pff5>i1+zPifW+=GO(n0yYb+!Z_j6y#qIv7*m|-3A4Y4
z1PIIj=ieZZJLvbBzh@Re!Ki=F`p%Gqo$hful}Ys9L8rguF0e5Xi1T{{Qp$;u|M>v|
zF$eyC;=or9QzxpET|}T8v*|u7F=4DHh5C04s_m2Q$M)6Mx_GGsLAJF3<72P{ieYkG53YH_QPwpE1sskcp)4z{gXp{
zvrBM}$H}`wf6U;jQNKKZ#!spM5vX`XC)_I<_NK!vZSqnb>k1vVg^y59G$2qVzz1l!
z5J>0+t;E#visu~0&?z2YS`T6IUAyjf>68l2Xw90Z{3YrB2fLP(z)U1StU%6dtgOf&
zGY3DT(msOBfHJj@Pj)p@#hoCHw*We4dI0D4-58aw@`%wX{PD&Ckp5t&2tm|LZ_HeGxoyyQMfofN$RE<_Yaw){
zB5vp{GrO~9z;Ryzu9b_merzPemM3|autv@b?Gh}!1(o=NdMJKp3*9UV=nqhVqW$5H
z)rKVt=*Rsw>Cul^ZA+UJ4{pB+=umR*fMesfZt*Y_ePb8E`8}1%tvA+w{+^=WM;~}U
zd-iG3viK<-Mk2KIaM8}Mq}sMLCuSZxaMmOmiw$E^3TxuDLfJBJ{&vr!<3lBDyI7)~i#sD4m}>
zjKK9}y-aU|&u?`*`G;4nY8?%SnXJY%@g3~DG%G5%$=6T6;V#+NY8zPC0R@iiERQ)&
zEH=+~SNiNaDsft!ATNV{TtY}FHdEtUF$UQ+&24zkd7qWqvAf=zMW}7bX5&kCk(o1e
zczE}TdZ}>qkXKug{^7Q^Ff@$0DN!3IdfqRR@w+6e`H^x0S*#jA!>1|OA;r;^vld>I^)~_7se@-=i
z8BcmFVn6)syk2e`nM>n}8+X+&%jKa<2EVK+bkruYDy!>H4)Dsvr3R?D1GW43A=lpQ
z!-oBzsZyvl*Fzl$-MIo+;nX3KZH(^sZ;!rz15v4YP^cjXKz$Yld+~J=dd*4oBdtzV
zA+KnO8}A*NQhFI-|NI@pVA$}@DVg<>vIL~d*v;qZu`MmV=Y*V3Z7
zUGc%*%JfuQGF?9ZB~^ANL!V97PmOO#Z1@Ltqi4Ke=@UqZXUTAg--
zZG+lmHvCK5>G-CGo&2`hswRD&%EpCzn(W{(Mg~yO3&3C)JezD-{7N%$qaWW{=P{RU
zd={58f%BpfmmpSeJo25?3Mqx`!_Ci)92V!PthiQ&voF8voXk+K3-H|S?eLC(1>~Cd
z4K0o%+%lFWz_|t)hlP`Fw&)LKPh;}u72D3ctr!l~?k=~<9Qj5!l*$c-OIM~!&busl
z4;*K>4|I{;XPjUGQ2px8anH)&nHO7l~=7Ca(kZ?LEyX6cLo=S>;fRBRZTlubhx1)#$@1bAKn0WJNtm_A>xAq
znKI8~`-5ElaB9!>+_53I?c9vs;!Q|vipTjpldUv!1{?5`x@H61J)5k|M?v+@{l`Ab
z+Toe7o=8K<-uS4Y?|1#*Ya8#}3EgJ0ev;pdm0_(@H!1Fp_S@TMxs5n$fOMf7gQbtR
zefWEo$(3!tkz-^1#EGdf9cg0~yT)v2Acm;gwF-yU_%+!TKlJ-XWq9TJ+Dbb%1W3~k
zZEI%NVA-L`tdbPMsUA8!Ql!rBUgS^fO}h`=dFt*m4_^l-B^
zHkIJ%EO>4;deJD?d+30>#P|0bActCDBbSimRHg8{h~xMV(c5<
zTXkL|;X^yQi#+pXm=5kAg9aV@>G+1jn(a;W<7L%I)ktzs8o_%>QEmQ~c<0r7lQ)f}
z1%nQaZ|wa|dfXQjK%{G6|4
zWM!>zoajg^7VMSk?Ak~4yB$o2*LRJpR$ZL~#Cx?ld$70>AvScwZ{}+xMrP|M?%;ZE
z|1x0Q0&fkhjzgweRR*PU4T50H*;gGHaP}j34~%{Vs@k@t8xStWTw7;EU~gX52e2I2
z)0)q%y-zC_|u^W*YNKXVA24n-J^=^TVWx}V2d$X#)Vn`
zlmBr4jbTmP#(0{%Xh}()ov+Hhcf6!bWlWsYwve&t3WAZ_y6P26HW;sK^=xtCU|iC-
zgjU$qo1iZ#2+U#unL!n}f;U3rS$d7#Tphex)zkQKp2
zGXF)*1Q|6qyPX}JdgA;;CL_|3;Nd)sF)?3RY#qK|!rpT06?E&?Gh<}+-)NV>z%6S-ey0+(-C
zq~4t!$JogZo_n+1gwaKt4=@g@$;wL9n%HH-LknXXxoj;!uUG)r-1^G$PSMktqSlZ@
zTa1>;f!*=63Ab#$cr~KcYGczs}o6&1%Ym!^K@!d_w;l5VUu*c@in}L@X
z8l!LDoi8%*PuE5i*Ty>SY!9-h1zMywc#
z5y{0Q7V(XzR81)>4{BbLep(mG4V_vXq)VxN)<5HFVgwhim*n4q8Nmx;xU&_A1FZ>8
zummnXh4o}jN08uDj~oOUmuB`o8^(92@mMrq?7sQp;Ye6$w*k40b;0gXXYc%AOKUMb
z+Rs|W*6K{=eBq?o7mwWu!EjO@fvuXNx$U}mmc&LAzl`M%f?dEJw$rs8F0Sg-EH-Ve
zw%D<*Y)%8#=0tMfP{e*O4$3k!}em{=P@{P(ri#(z3M10v%!{i_wa-51fpoG
zKB9@3xw-nu_iutv*oow}hJ}TA0DX48Qgh^^seCJ6g~7vx#7W)FP4DeDkjA*
zV{&TYXq~FzeOT3v@1Lr*e#}-G-#(BU^yhN|S;&AijpT$TfU1fL&d+@pAAj>
z7ILQ4e-&}_8IO*vH#8cb)B8m2Rnb(Z-9^LHswso-+VVE=A?t}jWjjn9rQ`A9{b0rs
z69Q~TuQmKPVoiiLL7+>c!suxKE%u71$+V%YM?Wr*nM_WZ1vMidYiLB*A|)8l`mepj
zmn^GG*d$va6<~8E)dR+juqxka>R%HjX**x2HM&OCqnD3Y12Xhex})cH>W=Ftw|Vs&
zyj)D140o1B>{gOxWb2k~^3#5LzdvAtv=z>4Az!yze3hxv9562@tGvMC^{EajvD&aH
zh0>AM<>A=Yox)?WrfwSRif?wCe;vE7x2_7<Oh1pCtX?Uzfzk9gn1YvC*PTC-CDwC4*&
zuKU0Un6?Y%Kt89zE0Url3ta2sP~2Z~{6PQ+b?aAP6+&u;C|fdZAg{ncST(91Zj0c4
z)GJj{3l9L87%)3tQb%hV-Qz+IE+uq{M4-S?Lej<;=`!88Cp*UvzBvsD&hoEf);5yEd;y;FJ+PzwwS0IyfJkUV6DKYUBx^v5sxWs
zsVk&C(%HV6UdN^D`vFo>azKW^5;Er4u7c1fglP}^fBeY&k7HB>lH(>J#~2F2wsK-4
z!a`X7ADq>6Wh3l-Bpe&n
z{Tk~@5r!ts=@+C4+x{M}I9p8J$t6i9?Sh_BC}y;CM1_4ar3}R9B0PsLGvfF6j78Dk>at}h=CN32+snKdgjJJF8QPp7k65Pt3X|DxIMo(}6WDx7
z!Y(uP@aq{i+YYt+kZz6&RHF^f9d}e&oKR7+SC)q;)k{yN
z@l=z0gnk}9py|$@AEFFjPG~)lSvbsECHu1)6cpx6pY;L$w5qBo>h%3~dLaJic#zyC6=gP0r6KmXwni#V=^I(z`P&kSO}`Gr`+8sc^DcM*
z#_#v|6cCKEE(B=ok?a_CvzKg7amDt)O}N-#&2)
zVi84vC{8kE@dx!%zTTyiK^)ZnwqJxBVfl-4uBV1NT&M_cA&EW?>BXZ%dY7;BS`r?f
z4mKtQ@3xIrXEph1@``;W_Ux|>ojOC9)^LjFX>C+z6D^JC|
zMh^njf!||+J{a|}Zn&!ct)-Ev`@2Hlu7h#>LooW!bGAj2Fv;;OBh~ay&V>hz%xZ?0
zWK&-o2K=sK5LP{TBsQM4glX|1rG|%`VRn+VJeFR{q4_H@uWq$qDIeOIW>%K@y4*E0
zxcr9}fd$u@R@f?OiHl<0DsS|pK>wTxGF22CzaG_RKwpqtedEMW!ZA|m?`^1n8p!2*
zIE&}=netRji=1&K%{m#NTb}M+`|$5j62TTMN$OQ*N#W}#-~`4UTkPt>hsw@AC{BbqoP!dn26j;Z#kDKzB4zy5vCg9
znD_T_!CN*3l8MJeaKV)5PRhFEzruL^ff&H$ywKIGUM||e+4g!eF?)^{uQBM
z5Z3wJQg`cfPZ3^*Ak)k_*DJA!+fMxQa(}NH6zMGX#k~QYHd4csGkBxVLvh2!o3~r+
zFX7p0NW$cm+r$SQbK2-l=t&~hTVxBz(D#)3-~3ge=cusGB$0FBpVuB@Y2`lVko_uI
z`N%uY&;1wMXM>!@ETU%LeCD4aBl?^>L$%t)IZNfI`j<|i>r9j}fKFKI*+@8JTE><5
z){mj$@9TY*9FfPUQ0Gu`3z4nV8})@r+n%Quh;T?BWiaZ@^9v|y?;umQI|5}jQvZXZ
z(O_q>K$6fG3j=|BxTmUGwGH}zzy|d(0xt^Qz6ZQEUA|r;l^R7&_2*$=0ss~jfOa>k
ze{;I*Oq3*&^gVB>&oI9X{Hq!&uV9@)ROCcy;r}y7igiu}#D5cjS&^OXFWupCV&e*o
z9wa=Y
zm$PA{T7BQ86#DP%y;sgPtsYi00txK&#F~)0dPR?amjJN><(Id_C`FRcGf$O>rs=fA
zE6)8rioOL)+pn1fYzzNd51YNzUisT?CM+mm#X6HQb+(o0qClF_{VU=d8)9evO0hNh
z>*uj*q@Vc%zcS-+@yFEX{&Hcae@=p09FMA`piBE~cqd2`(ePzfu0b(M?RnQVCVj5+fU-@tcq%s$BMy9tZSvlrE$s2zF7ax!MFKlHoAakY5FN@tcWpj9%KKM@qI%v;T(xLR#I#_j>pP*}kc$QgYQj7mB}U_Xlwx%NtCNp8y5^m6RHE
z?tW>#B1HB1&DfbYK%x5g;J=1-PUF1E>9e5DDEGcgWiM}_kU)a2;lviQ-SNs7r+5L6n
zo_NwtdIblT0Iv!fknGxar0zF--siGO~{=5v7+{
zK4Z7|DxMFwC9R?w#FX)-e<0?Mbgm&DC0@Pxl|dm=C~(jj$-+oJ#tw`jgy
z{cd%9X9&}D*+Ki*?fL4r;D3Zji^{1W4s&%$?nphKsSKGAMjXx(*ZOqEw&ial$9Y!|
zzg7L5v}whB5i}%{L>_OYc`E%nI{z~rS6a-yZrd2K(7%#(O=`To#PE{vV2lr5f)q2n^S
zXHagZhM-#{E<<*zi^fK@4+0O1ucpMfgaEaE&+C3(QxL)VX2BkP)1Q5}H;(3q
z{!mSh>jqQlGbdi&O4^Wk(kj}JsD0^CF2S`<8(#aOQdk-$&~D{dxHut6=SUHGHx!q
ztUKBcO`uR4KXW6b0ZO+x{68x;mK}?kb0}tIlp!;94GZi35uKDFh24)5
z9)DquCjaf)HZF%bJf#D`qIOmh!VM=0h$Qh(vfi(isu3oX5o#&If6$ysO+{IsvvC9P
ztSW-lbIi{on&);Ht~-byi23=}@_s1J%Bqw>#)fw1e&r-)j9FfeKW?wIa5cL4N8IG{
zGYxGL0f#CAaIE`We5;^{sC!F!_gBWxlUbgxbF7PAkC{&TIBW30ws7-q?>QfV(6Gh4P5|
z?ng1lit;QbPV$~C10Y}t%|pPDgVMVVqht)oi5B?RYu)DN%$5Eb=?@Xk!(s{1{b@ph
zQL*^Ncl{0DtnZj({-7YR;0BWjq}}xn$eq(cy1^E^GjU
zqAnAI|LqTZCDwusIu=(a3hYt%rwl(JX0)FeP!NIsEnGOq%u0#2r3bySmi}WR
z0k>aH)
zau5x)7oSLE9{XRa57qm(Op>AEOuICHc^JixV_LkJnLNJ*m}%RZLqXZjB5
zqD$7XYoqkW;+MD_0dWHHeve?|wh$D+RqeCgXZy~!_g}7^`MNDo>DjwJN3aFD{A23(
zrFqZEL(JYSq_SUV`ya5Mx*Li4zT(a8H>=N>F#Ty+Eb)hLY^sYZMUb#T>QsFEq4>z-M^AF6t)!m
za>nwjfC6pjLMc11X}ss#^rh
z&e^4a%}7r5*iGPqk16`^1qu@!fvS?p-59&MqZd^=k*4)CWpGUOC11a6eQgUT#Nmc3
zx~|j0dX=T(X--=X-hVAJa$^sb3WwrlYO#AV9gUQJN7Wf8dwU)owQ%@%eB&MwJ}MfE
zf4U-`_AZ+pk#!48Z|e)HAM>6gF4`kkGRc}$XN*1SU^kuo2Zn%ui}Fij4CNr5pj3c&j30Y6}>
zvgNBQ0=zoZRvTTBLZ#dLncxK7jo*ps4fsr|nzlGmo#0$EzVBif(7CLux1@WAi5KZ4
zolmew(nQk=Jq)(7k8?R>B{=8P%fFQXww{phIR&x^{luJ-wUe4$G`xC?hmM@vF9N(*
zj9q3Hoz%QXugiFA(R||b2RaJIw9n4MTlAghGdzkdCp>G1ihJ>n$3~I1^6Gq%_J$OG
zYK+z3YvkP0>8yV9kcy{}TsK57VtxWXg19C)2lKJGlNxIwVfRlHeSGaJR>BjSJtb1-
zS407-3bzuaI6q-bZAWI}pj3p;Uv22L6}Cmc{g^Ued{x({(6X8FnJ)F)#m#yX@J&eX
zsuZ1sjhzvKc9?KFVz-d7&RBT$QPpbUA$`hm-92rH*}#OXA|;phKW~sE^;;NVxE*CE
zrk3~}XMQS5)vpfHHuuoBFmBbp)SZYH{DyWh6JBx~a452&DQU}WGh+n{&ve_qwU(VM
zR_)w&m6M{VQzb;<@{ZzU!lwnnyXw$EZj&~>~-B9~+A?<%UTvX${64$uWx?`-0#`
z9XreFtC%0_5pKGGK7t^MwbqOxWe|-85~ECKamTU+{hgRhB#AnvAqQ%qqFM
z-ys=U@pL63Zn?snP*mz*)z-L-xJ0tZ|0u7A5=?n2xSs?3eZ|{(uGM$8T~B>HS%fC?
zopPJqCTx8C{N#Kl?WjTZ_uB86dI^6-=sd(&O7xT*+O?a88r-%BbG~iZ`;`5d4$WW#XRaAqxm
zw6^L|NxiTm`&dH7?DsiKM}u0&4{0;XV<`+6Q9LwTsMrp7A}%2CKe3mb-a`=r0x)Zf
ztQM3fp^zm9Atq#yAwO1L`!ZXm>;niQa9}2einO^e9Qy&fkg>*sA5`JM3CN
z6V|!-DXEt*(-EMUg;WG_ez{-6LXgmmaZOLVaTsz?Q)h|`LHh-=wVu(mS^CL+dHkEW
zyiIbc+0a0{JLVr)_vvb##p3CbKd9gm`U7_{7eu;A&sIsAIfxf!nbp#!?(7^4Yngs1
z9SU4s;n7GD?$_r1^xds+7w^3RQ)M61RhdEoVWVS6Q=Keg_q%@v5NdpZOYag6nRJSVNAV#2^#MDj4ZQZcsR*jL#;hk!@!!L
zp(`=}m!i%jzvE31p|nO!LTgX%#3S4Lt|go+MN41TfP
zF^ns(#PB~VfT-+aNW-{pa`rEBTmuDhvqq~l6ssuY3H*6JC>|8XVH8Q+b4{q+`5
zdMft%?a1i1GmGEh+TxroX?5!+I5L?3Cr2g>gYZH`mI#2RK=uj6M8`?
zBP9R&xMB}EnOLsJ0u}6UTyKmIxX=uE+CSi()3*4^+?!yQ7tXc=oTLM{BxlO={-d37>G;k&M3H3@;
zib?2K*OQROZV^6+)WUvVH1Li5^{N0=5p+MT52;^K$yQxo|U8
z$^W2JC6O|!>FssQe5opL?$>xwx7@eq$@nVulOB=VS##hG_oBzasGfUHAP_upRRp_s
z^)&nl)a|1!^9X-NAtMZ$Fiw)SHaKg}$^5k2(Wc}@Ei*lSU-GFQV&*O(B1mJqg5`g7
z2~-Jg;x?VgD;GZ{RbcZH|F9#Cy(bx*$3l4T;qq1kZXfMfh|KTyzIhk$_T|2W$S~zy
zV*^iEe*<$KlkWu?{|&%(|XiZ4V9oY{WKY1oL11IP9ojG6CH@BqSj}+}OhM
z&j6gn|HY?{!HvL4)`39o;@-;)k%@U3Vt!6YupKAr)APHZK
z7Pogi16qz>T`6~L`;Uh|2`#@#k`qhW@~eDl=I}&yh*01mDentI#Tvz51ihfrxcV#h
zgYjuvib{#5iE&lboWu_NlJI!gruXb9rTq|3QPdEr+BzegmB3m^T
zVPP?!6Z$D0Re^?0yRM7}AGw&q)c7*og5~Y)RR?CMH`=)P-c9n#AOQ)gCBAUsPj|_?
z_MEMqos^rIj}3!Z+S@E5Xj`oN8oVItJgS>!90ZJ8v($%DZu9Nx*TpN499asndoHEM
zrFv?7%ge?U1({Y^-LaBBNsx}+$OUu4k3sk8G~D%(r{S>NRU7apMpC<>PZ;|0bEvf!
z{!vT3`P-WWYzk=;P-Xkztqom2Bk8Z1timE9td`I%%(3<3lEd?7xgkf_+2gTpzz2DO
z3w=&ViS&;i%)Castq{glp2@&&-fKKGM%Xwai}zrq<*On)L;$F9m%e4c$GM
zGN`#)Oyh#xCwX<5W53j_6T5!<>ouwpwHn#7XMlMJFJp2oa<#RQotda(S4z)2xJi3ew(~D&!td@gN7-o
zPbA|c2^J{<1b>N&(%jo2Ci&w7QD!_1iNx{yrnj#Y(U8
zazKu#QgU7mk=LztjpofKHO0Ky$0@c{%XF*LvOK^N65hs2PXq&44<*dDRH?FMCFo+;
zV1M8YpjGbXQP3r!A3kAdf&K{EcXge<*k9hN-f5)0$-Q%V`M&D!M&3(p-I-8f7t>1K
zajznn%D4~LQ$kw^MdeosC0|O`%aQprr={M&a=-=^pkq`a{(=V2!9AscL*m_}FtuSx
z=Ci#GChm8}`52X1Gv43>1WVvy7iX!+we@Af2>^yFz1BB=Y`0qN!^u(V{{3N-CD}r^~#iF{%L@YIJBHJ*$Zf0j=s<+L4%r{_B#-pueS8z
zmJ^AcX}S<*EgiA*=H`{t58JHy8b2DkLL
z5RA7QG=vTpZxZmAOawmQ13ojg0@@dtlY<8bdHY_w
zw$-OZ>BHvY*P>aP>y!
zcgLJvj_vsUb)|tubI3}!4YJN9`A(dYTz+bt8Q%M}JT12lrz$|X%`kAkh0|}P9NLlj
zEH8IG)f08QQ_44}R<*KPd#}Z`(&P=HHxSfk=3$3@2~?Ra`*pwcs?xOmAn^744JP8n
zOl+}WR~jYE_&&V$m)EdeH<;ANc&xX^>A>I4kRlgaz9ZTAYhD3oKu90T&1Y8eYoVChlgvA#yEKLjV`CCKE=Nt%
z$1}K=83HaciLALF8;}uIl^I^n-ypaUAPEI)l<5b)N_3|Z+O_5(l@#;VVuNB|aWps0
z*66Ny3&f{<$HljKXLh)GWMyvsK?p%tgMcDCYZVO#Jmkfw4fix)(wN#^2w(Ebab0u}
zlTycqiKO%;)atU?oi(8Dka#&hZGkb|?QRHA=qrwuT;Nd^L_(KQq|R8sYzJ4rZs%X?xBfX#LQq)-dwTR$S5O$v1zSNM1LEUM(vy?7#WVy@2VJ0PNO4JY7h`_ELgqu;_8;#uRQ8f~XlL}ldUk@HsJA4tL4{RRzm_W3(
z&{|_%IZ5^{2D6-05`cPmfzSj{
z!I$wit&nMgP&t2i_2L!HFf)Eba<^!Wx*nPxbwE_S!x~#NhwKA<$EJ7CyEL3_er-s;
z5+r8@pU;#E?8?u_rxzTrOf{^FAvUnPJIT|l`g4KMGr$%EXe!TS!%XI$7w;t
zINXa%qjXgXC2Vt{^=8l{?l@(vrA{Bce)wir5@}La(EHzJ;nGbXs~L%@$Q7@+Sy&1D
z?sT{ed?4~2*U;)0rHQ$`1q*IOUw66pElrrYxi_6@Y#v&^Yo}q^>_KMUR=p}^)3oKe
zo=+$~vH80DqSKPafS!gkLKtbq^yF_>r~twQGXaFjm(_3j;q_M1?heh?q7e52PiSN7
za+kaB7|xHWc`Ajk)RVY1ga)%*ude?rii&X278GSD*9K7S*L+?Fo867|X6U3Mbg~4~
zVEHxk(ev9K;$%K{wu6$~3((+3!Rnz*FjpEfZ`u#Dv*Quvu#9{E$gkYYrCIy|VKR|a71jwuCICbrZel#~Z7GAWr3aiRRP2vtq+ImP}`AEJ=
zs}<4RS|s1N4TdJ4yBA^>bsD?00PVOF`u^#l77kX8Z>7G`OG@geH4_rDBEHNsR$Z&{
zvf>UgG~a<;@E3iA7kI|!$pH=N@cSBvv_g<7{PTy>12C90vfi32k4?D
zA3y|0?mM-AM1FKs7{-rd>`nA!rNvjddv_&Xc(Tzlq#W>JjSDKZunky)u!gA2p{CyP)ybxh(-@V6mm<{D66hwm1$2|_qRdZ=3-@V8oom7+uAFiE8YI4v
zSlk=e^l-_mcrw`(!M;${0#Ik^qo)K%`lSDXj9W9!mHC|JHK~B@ouN(!vWuaY@75Mp
zo*J*b5ugJnJ&5I1(bjm#DW%WQjXHZp&2}?UF^vZ8+7WTjzHfEwywIpSEa?|ert^`V
zzq&5fqttUL+j$B{_Ve4&t}+!
zIs2%_ARs;I#1jTeXg((x%;9P$29w(?7-`
z3X0bVopN$kK>vyaxXy`%hj5Ftw-VYd9;Dt`?)v&X0uyVU4LDVESaXKtTbFzMx3?hr
z12nPg?z;X*9Z&Xg>DlFW3wrB445?lKlRz=$A>}`X!{-_i;`e`ga9J1%a0U20>yUb8
zU?RntnAXQbL;i89Qd-rJ2W?
zrL7-RqkMeZCgY%8a+2N;aSjrG}Og@Y)+
z!Z#C-eF|@W=b5L=W)K9YNo$MalPPxZ^_
z_3v0`zHLr}AEN9G`#(>VlE3|YxUrv-?_ka#KK^WVxjx^u+)y48eVmxOmE`38yah(k
z^`Jggi7jfNH%U27k$pB*aWM-{>z6)%&sLEr=+q*1laY_K?N+x3EzLlh3
zF28af^G>a8WoI*X(f-80ueRwli9W^%;Ow%(33(QfzhpwRKJf8_9M3zhyRj1&PTL6$
zc(w)&P3}7V1pQ)CnxFku@1wf0|DF$>Ramn0*s{@e>J6H`O+X-_8@7VPD4C$SV^1Pp
zkk_;dqIqWLcRi8`UAhlPa)36p0u7n;w_rM+*hcvkORQs8j{GV1WZRf;)AB=s=4(XV$Zt
z&TlN1nV)9zQh2toYrZX}drP0?sW+4bc=nBYhHzyux4Glsa{=p5`CRA8sb(HECg%_enw_8ki*y|iNAHU*D5G(SHT~^W)YTn|y<3U5tD{!mpy6zQn0{Yw|N8t!
z@8BrNSHQDri7D-^dtDP`2-sb-vF}&VlnM_i>+w|M%)8#XRFUJcz8vqo#iJwZ4mVkU
z)nA^gK!*hiyszpag+EydJ|(jCD9~gP!_+DU3Yb&Zt^rrCBKl07a&svj`ND{K|Dz-T%H!DUb@o940@|(I4Zz<{0J21Q
zp!9!OaSjDaVfS2QC_ipZBz*P)O1XZ;FJMPAvE{PDDwy2_0FfrP&7%HrdJ6quXulSR)vfmN*{MNJ=rXgJ2tDuIRn*PV88zCsU1ky
z7Y_M-ip=(n^6w|gB@
z?;YFTx*eun$)aFxmi!*70@Uw;zpda??vngX+n2~Xrgn2K}?%`A^$jzcB5Fdqd{4f5}Nk~({;bbYymKU%WI
z)X_To*z|0m?i(I){dDh;)6S+N+Sh=wj4wE|y+7Ai^H^qR09TexEg%$sTdJO$hF7)j
zBzN|yDaL2aQdOfNB`(Ki|KfLcQJsdA)ZcgiFhgz!u&8y|(T1Q!8(<9xWI3XGO^OiZ
z9B6&iRe-KW!5wn#G-R)(ti1{~oU+x+w~#O-Z+{{2#Z|nWMn=*0kAhf3f3`~R1tig$
zl{vu6Y{Ye>IiQ))W)rCJD6b<`erTWoMXmTwAg29lQRE2RCRO_Q=%XjSgZBDraF0w2LY`fR;t_O?GHIdH})E1)$5k9CI;j9_>mG9rmy=
zYA_h6Hj@yGiCJcs*l|AD+ZryW7D(uU$uy0iJF{Ah<{xW!X?Q-=%&gvjVatY09xa-6Wg@jz3+G|
zlV~@#g??%NP6*B$ro}J<(=!zCk*%gdM`gSB2ai7I4Cm=N#Ay+tnJXUi)9d5CvkhG-@{L#*(F5;GE{(tYcdc(P_4%0}`
zMS)t_kB>aWSD{u)o}%(hXXNx+T@kdT$!0UuY}OlPwKvxHEpIadMFK7C$I+PAoe$I3
zV>BnDz-@C0iY5Xo&WDFD+;W;z$#^u=J#MGT810<}uN_d&w@){**s*|a$fJIAtxU&F
zD1LsU`K?XkDo#RYIytR{$=RNo)s}p#XpTjmtg|Kyg90XFum{SGhOpx*C{=N!_isTli*7+f{=q_`1UmsPXw^Wz~8`uI}Ws
z%HbNh-S0iPyW>YeH#kJ^thZ;Vm@SQA9PVyj`ON=7KH%AFwPVOMwQRzdy>y9XEX
z4=!Xf5wNc?+UUMAi(UX)8z0CKnHI}11biw2lZ0O8EL-w_o$IfCM9w8jlW-}?r-j?~
z$(Y{qtX1&&1XJNF!9r7U}{Y8rSH?a5bE3jlV=oG6gwTmG9YXKZH^^rj${M{WOu
zGxgoUUo=wVKdAz(Lk!%iAS#72>V%FJ6hc`-+HYL|#3m;6uwpUh0UW-4k;;SdYFq3j
z8hNv2TIrk{bd-D?ObRp*#`L$oyuDA&7?lSkNatEP_>$YF=Yv;r&OChK!K`*G;#-G?
zK3LptU76cV?DTt+38yn8$n=Wd7-mV2B;fN{wuRQALLS{$3b!I|l>;Ti3lDs*dvFwg
z@^(3E7AGnbzrLiNTqwrOIIk!lN9Se~-x$c7dnWk3M}4vJ+5lAOL(d&ZThq10;#4ex
z$Q|g=C$010sQM$4fz<=g#P$)oyZv(CaUsM12WRgc*5uZ`4F)|}K_kFLj`~X=b`0I7!a^NDMtO#ffMJBZgcnt9g7v=}FiR
z`*N|`obcn?l5zYS$d&L=_S79LCL%$6&*m(|I)&SxUFh0{l)KLLAqq1C)ruUnA-*Ev
z<94=54NFNKayO0wYtQ~psprzP7c)L)a!mIfG#bpEdVIsudyNSYY{pZQ9_i~PMOes4
z@NRR8?sIT|67L2ay9Qv_@vQxQ{W^k!yV;~C7o=ez9L4l)Cq60PIg`J=!;nFuE<29kF_JXTojEf?H
z^s&stq*Ez0Hto-6D>+xz@kcGLJ2#Y`Irw#+idtHtl&^bday
zD2lr*e#Lq0#HPgn?K$eZC?s-Dq%NE{B;le{xf?EEdSE=`Y3~*-Bk}=#wDP#6G~}5E
zGSq}F;eo8ItSRM7NrcT0)iU+Kv|=FnFiWU}7fWxz3$H7O9clT5OaWYz4Xsx!GkQ`U
zaSzqXSC$@nyf$CpWPV5yJrl$$h%C+x9Jv}{@m>#$K`90zetg1dPc89!VM*{
z)u(BCUOlQMXt7h{!Rb%M%hP5}EG|orm1MRu%iisqgA2X42oNKvFE+h9UBle)ut%k8
z4#qgG=QwIPEnPis66QJXSZkuf;z6>U?h#Hj>bU#}E+I)w6BxH69sM~g{m5}t$ad6f
z2J-EylBCTHWT41Sa_{3Cx9Lb|8{;!P1vo{zC_t*@gj#1Dl#}_wsP1^$xl6llKEag2
z*Ltw_!+KAU_~~IKXey^{d6Ya`e>^hX^XT)&lr+vIFh2ihXCa&Qw~VT1dfHquyemF+
z%>=jG4DxJ)Qy-m&HFp=yOM1+iaqrzsOn!6GqIL3X+i1JnX@S;YhXd{Z?y9QfnwHyI
zJ$?JtWOEH8hkMV#^Cl#bQZ?VMbiGj!=dnA}k~DK>K{n^jFStZhlxDPQ%SNZPE#V&}
z&@|sRmsK;n`dCi>0)(cQCk<3sxqA__ongK7+wcwZU|@0ewn3|nnvUx$C#F)PY71=}
zBPh2+M2_X2qLWdVz{(kERtqaZMvAR`65>lYFNl(I3)^D<-25-r;LYVEsEg_3V?Y@A
z@nOo4Ief1X@C-*+&lH|{5FC3mQ_X0Rh5F==Dv)ZZ8fUQ;Oz#9uE!l$Nd_keYKg1KI
z;lxb?Ikt0oh)YG;XTcRP1}=t4xpLXiCoPd}G8Xx5N~RZmqo-TbO~$G~`l}8a2v-1Y
zR)l=c)}+)CD5YdX$=kqa@H7CcZfv+;Qc{CTeKjUL2Yp^k3&`qo_gtNqy=hJ)$^E&M
zL?T?@u7;9;Z&QtIkO3PHpWB=cRWS70!t*azY;=gfZ46Ng@D3ktHOq#UB3wM)H!17XfS!D6VbkRj(TN?Y1Y=e}ENmL~>32z*=i^Lpmg
zM>#i9&)uK8R3U(_=6H`+vabfx^;JiRvrM@mRywJ=v0RQ+8l=Xp%3C&dm82b{#g4mb
zO(LL8v)oa;zu9wbibg0?U6RuL(knR8iie{tU70$|nK7qdw!|;nlUz=`8)ibT!e~+$
z0fR;vkSv#T=Yi^?U*gm`c56wA`1l`Nk6I9N?dZ&kE24uFtBw#wc!9ZMLqo&8NW~bz
zn#+53I^03C0OtE~i?7kAQZ-h*u`P+Vvb@BBE`#2{H3`s%ppyMhF&ufXMiz{-m!w)(
zjwrl8z5RfUynk5$98Dw_SJ#1ZIe{(&L*ydhbY55@8b_JBAC9+hPx=0c^Ozx7NPY>2
zsXKBm*gOm0?xOsWoA-&s>TN70rfeO&gg=)Wo}9`S6cx3Yx$FY^!h$W7zoy?C-{t~&
zoWp;zg0pWw`pFpP@|W31dpn4{OKZnSS(q+m9f9Y(2B8<%65S0-OZd+x8{zenQ{3O0ZOhWPV><`V@3AC!?^5uhuPG2E7z#pNJA3@$KsjUtd;Ds3x9&|8lwulVpIa^t<_cxEU)nbMve{yjE4{>B5Jc|E}8#KI~v*VpG#LSaz;
zXw5v2hnS~jefVaf>K%ZcAR;)vRXzv55Qo*ld}zB~*qK^Dp2OMzbq!E6J$I21a@6ZU
z5P=k9ufy6$lC$)v8@Y@acu?P5tR3-mU0xE+7Vd-XKGuu91mY(?-mJZ|g&)S7tl_?6PfEI=}(F?8b`
z#&sCMFKm5~!r#cA=U+U7zRp1c+qQUU~c;x`RH?e2VgBNn0*Em;5Ykwv6}}{4(Jiww1VXjndk|ku}!kKXm|kuKiJ1fJN;O`
z6;rrqB5L=?SNEN2Z^(a^lzg}D4KuPdC@72KmnK(q#HK4B)AEXH)8QzOdHBrfNwOz!R3KM`l;#A`dH=H$3mlZMrvuRq
z5Kl~G86kTXrraFcm|$srT8&Txx3m~e70j9Kg_&%Pr2T1LpTRb_-uLS_$9Da7v)le|
z#um^#jY)2kqb)viatVSVIp0jvmJ)^-`*XA~Vm`0SsV(FD36ZeDh{(m7pqu$+^1ljH9$;xNvA^Qx8ekJlg4&FOvoY{z#paURIY
zhOkapinX5UjCMq@Rqp{}dgs`;ECZz=GV<>KT*vRnF&)fd=13t`3L418z(56s;4iR^
zR{BldYsqqrtPUV#<6?3Wz+Q=EliK?DTfX*(lHXzsr`K4*54%YZV9
z1MOu(F-?{!n9aedmu%dD)FLj;g7Ja4#cL1J>A1EYWyVKi&KqX!8ezp$1fFDT@0Ck-
zLDK~en^5UUd=6B}2Y^A;0wLu$6Il7&OUQTj?>?iwX-)PQhK49Tr*1h@>jOZ+e17SL
z(__GTd+qO3AVRQXy%iBL_ZJ(vUOIOJpN)l^^A58R5!l;#sd^n*&l-oPUotoW_YVft{byuDQ8FM7XV(ov3t|CmU{>
zVkHRLRh+z~U0jhf;6~H^sWaiYKNSfz;Nt{~0N
zHW|ozly(g_@JqhbXGh(ytE&rFzW3H9Y|2B;WtLEe=1OdR4HOUx*$Sv?S=1JP{TVF(+QUa6zY}Jy}0^
z8&KcUUN_ODXY>S4oVpAVJM(iG{OSUZSaR6t&Of{{y6z|nJi<)6ljTg=AV1=N&k;>8
z$~?TL88jWOmT=q4%gdo#jy?vvWZd6X#N;Bv9TxG=;3MCQNofCG^63HM{%=JBUe7rx
zz|{2(RqpTk%Z>vkp94=YWd;r4DiC|-$@({MtBja!56csgegs;|AN@iAg?Tm9h5KkB
z2NTOi?mw_Hx#-e$DqIp2^8FMv4LCv(fVa-x9%tMRw#x0@A|(qLP?uF31*v|^%6fR?
z)~&y4h2%iH0Xg_3)YVQ}dSK++(Aa(f?N5dSO}_vVM6hQQt-`fq;1+G=L1$N^A
zcJbNlak#1~Y(p}zl*_Qo?C;-a0=U|PPhExzeS(0)6)
zuU`9p&7b0jsL=*}4;J9vpCoF>ug=u3gG&Dw#C$C?(FE}&b-1_-hEfr=!2Jt_NsOSZ=ohlU(xJ=))g6~t((KYf%NLFYPHi=XPV{w
zS4%CTN;?hY9B1wLV^yW8T)s~fx2cT6qeq%Db$hhy9NU>-Z%s^|Nv#E{HI3ptLV3p=
zTDi5K%$I0O0sAp?W-@o$v0c}tfJxk?jq8pTOp996@ie6Ni(Tmj8h~&mEXn=3x`tRg2fuuQ|bPE{Z2PFopeNK
znFSAx4&(Tieys?&Mb5x}4wREGZ08_53oUMC^1}k}501+FPed-<9&t!9HdUSa;&;?T
zJNvxerK@(Wc-STaq^K;0$LrD6Bi|veM
zXCNPSxgwgsdTPG`%Hy+z*C!yg?0kF=AMz7c!R@b`@3b9>p3?&`PJONohFmqw_|AP&
zlf09E9cBF^ygf9*nwY0s*icSWUQ_dgY`gfY+?s9)R#Z~b&xP$=w$clk%2cBGF}N;!
zFg;MH7BEvCaE=FI^Gw%h(}w@-k8gol_3Nz}s$Z+Bq{`-!gW86+K`R<|5jsERs#*>-
z+cHg{I}!7!=BJo(x87g#_Mf8it)R~lIB@7kSnBHfN^W;uX8TyDrFcD^|L-TJo<9#g
zk*)T8g4#rqs!ho|FHRxw{E_#aPvCIZvVkFEfOKDP@aMLX8@a;q7~%vX!>`|adDoV0
z$eOdu3QnB*DbNDG8!cg3r_WVA<6z4gzhYU%ekIybP1mFyS+13%9aCoE60It|TXQMb
z0u+Usq&8P6H0O&C#CvX
z4h9-coSgc^crvJYD_>Tv1=|8EJx0m>N-Zmj~=k=Q-^m
z_~r6QDPS#;$c26Io=sHDh!SH1bRRsrYsJ*<8YIfC(#t%WKCbfXjUi`}shb{IAluO`
z%%=sBOM)ecsnX1{lpve5cP(?;VyvnvQ{;F2#{$`7@f_J>hI-W5mUNx_vTfOP)D6Fg
zp7#sjs4BL}N%KS57}IBAOaHv5ZW}4mIOwiz(N9G@Nt4SS+jNuKDeKgoZPvfQAt|qq
zp-ewu5}WthXYjJha>SW+-YQI&kPcB`*+|@}Y;=#Wc%eo1Z={0Aq?`S<=C5k|NfZTYf*S6_{R(n?991qAmfJN19P`lFhfa;RGdxsx_K(Y(mqUSA;0`Q1)
z(7w83H2v>bxS+dU-w1HP{8;DwoxZiT$F+ltLgwea`}f)SMc=ktB6~7ARtjg-VOZz`
z%V;fp=Bv%96nzdi+Bo<6g17@WMeE@Qm>gH^F!vHDN0!_bQN!t!sr{npVqacp)6k*F
zeT=cwvTO#g&t9t*av0bN7N)M(y4Ib$NAudYbjwAz{IF=Um1J9{-yvd_h8^JnTHlXt
zBYTAQ?v&?fcwcC2MdfY6NOt#R^2{0EKfs6}!i87zd1eO%fZF0BzvYO}=ZT<|vyBk=~nn`a|#_CXKA}}U|C1>evDa#w;&nvPV9O+HU7Y#DxvI`$=e2@wVp_xjZZPBfq
zUqif`O&t~q(jbOHDKL$>lY)b@&7{hTJvU{W4zCB2QbaYuM)INo+VUjbcy|=Ii;zWX
z1@;?v9gcs&9MwGj#;BvJ9>?V5r0MzKE?8^cL1tOTp6=MbmLsQhNUPWJH%AXSa5^qM
z5z%8`GT6^0Z{?aR5tUQSHLL5CUQX=#Y~0V{DTC=e{-O~zI_(1zu#vg#j^u7j!!%dg
z_~qo>SKYJ1nA$^QmV@sxaWh-{@lXQ~AeQaU`Is;%IPd02A7tar9064~wBCUMM7+mj
zJnk0c$5uH#>Oo3Mud~pCY`Z?}GQi6k?E#W1V|V4EunhbnN)bfhDOT~QZ*8xJVpmpF
zb%1-8<^q)#rWO;s9LBzAmLjNH0p-Oyu+!#);F|Y@kvbAzdmB~nY
z84{MJU5<@MvR8-9lPgl-jc}HNsNE=+T}BIz
zzdif^i9Z@K(Xi-ahDdjI54OAO0Z#V&dmo#8?gjOJm}EW4Sk-T`EZ;JpZnhLpSUdvO
zu4d9Dx6X<|fgeEGT5Uk`?JJ?py6o4fbzY@YCidfVTil$jxe@an+1D}2y;Tmn)Z9C+
zFM{bB(_T5^T?8w)C$%1AYpevcV~l%p(v&2l4cO3=oEB@Os`pGlR1^0DKA&Cz{1FQ8
z4+9$z8FG2Vzw80ZrMEkU!|iulhSvtP_W-nzkdISE5)XAPy&eKU(25|000L@DxJQB`
zOGo2S#L`-TaOZ$3J7yLLDYx8kA}nTV24u1H21um$bwkI%Nl&WMAj_nQp}kp5US8!a
zJC^-fJsxR_IKym$Bf@ejzJ}e)5q-0PIgdpU>GmYIERv;>98NWIB8wmTk<;j9y(^N<
zwZqvpq=+mdh67x_k<0
z;?A_qH@`M-kB~t(9#zyDZ#mDAo@|o4?ic7s?IywHt=;-YAa8WJF8g5-M>nS%@gN^F
zf@j6M`Tc}dMDg_@(xe{%U)Zq+9$O`eW=q?jIb(tT1?=yow4@QF%>hZ5BA%Hwiu!`!
zK<`WSounr};{37Y2D0^t(^53ow%nYDVRM#U#`d-uotT4OW35O7TilaWDU5&2z9(Z;
z1sG-FRe?$%YM_C@Fb$(S7BJy$S}lKo>v>t6=xDecA4T;EzE-a8w|pxQiEITzJY5QD
zb;sv7L2~mC{rJyI0`I$h8OEJO;1|>qD1Q3q8Zz_noWS4U{PXu2Xv{;;ROXl7Lfy(Z
z)8{@C*GB5;cl3DE)1T40@4h8CPkQb;9UAzdeDh2cc1M-R5Qp%I8=cN^pIMX+Gj~XXQ#=&C7{aAq?+(_?{YzsN79H-^2y{*a$!2{@dpcu}0jUhnR#_Diaqzl{mNcv(yB}=ZE-DLNcPhEAztc?PK=v<~??sNX9c^Uz-0uH>3flXJ
z+y_W|3A0cCR~MlFR<%QOjD)2Pg%Q2D-DhAFRk%~RjzFe%{nuA@8p;6;E=tD8*SWJ-YQi5}&)62JTcA;z
zQG&*^Tp}guGl&K;asML?lKHlBgciom+EjgR#@V@mPHFjlvlq4yRax%S!|A>iUluCc
z8SO%uHrvsj^Q+%6?;wAE8+9-;o124eT_b&0>^8QZ5v7E^>8!dkxVr;KD+KA_C@-r{
z_HkOLjmI%JSdScj(mQfvMc+*{)`*vs7n&itph^5RjC2FH~bgV8?)A4R@X5kf(
z>Pm^{aPmq%l^Nj~nvN}Y$LG5&*}q$&tNEt}>v*QY{nnNzLMIoUhl+cA=_wrWKNMKv
zc#=C{64CblH&ZD)zJ{-2~xfX?XZl_Tx7d@V_
ztf|VzyyIYJj+|59v!ks$A`K3Dhy6T^m7;YLz`N)P>P&@Az>W&?{1QHL^FUfm+@d@3Pl?#+m4D
zq;Lm59ogp8`kGl23db$zR6Jp!7s(aiB53zt`l1$4?|!`HC1d%U>ZHmfAfxdHfzSVj
zSt*|ZWoR7T!y!tIoH7i-*-#hfVm%+l;=Kn-FRPh_48KIWeY_q0tO3Z-xL;y@o#~7B
zW&J#?(p?T;Q0%G%<=m7i%$k>rqH}bo-O^(5`Bfe+hLF?mGh}(sCZ{{7odz>WlwLL9
z7jD0C)g8M(0`9Rga9x7Q0R(;1xomKAPbv8PD{Agd+sZZh!YP%YK7{w>RnqtDq{fjDmWRHG+zQV$2~pR&FZ0x>
zG95zIfz`&R7WO^3m@)Jx#PCIXigk5-5NPnRh;998~
z4+}qnzT4jv9-F2>rpi?KSi1
zXq)5@a$}dg42!mktJLvcv%bk6K&+RDi3;*I-ZdWictwtBxxj_4y
zoRex@z-~|xH0sT<(1ZONspsxeijtVT{$v{fp_#T@!B#E0S4IPt4R_EH&>bU#dh?XV
zS9uWpj=@U*k!C8ZRnb@6QIO?yUUiu=T^ov6_|XNw`AfDCu0(Mzv0GwnSTeRochs|>JK72p#wQJW*&tsEk^0>&w6uAhz
z!qzwVDOTrx#GPV`jjv-q{0%Mg-ol>9S*i7SRXdULi
z0SLg%1&-fnmIh-oJjmc!%2rfiP*PDMVKHOcqaC*_qY8H)n%wf9kIgZ4)~y6phTz$X
zp`{`ZR_F^6poj94~n&6_;~6
z=OKv2J@#%1rFmq@py2fS1h7)8xi)m%ymVW@yLXZNZ@`oKgSUHw*|*<=3qt<$b_&tJ;teU?FWSXxI-OJ`QrviGuS##|jlmjVKDqRArY<#>1&KL>9D$|UkXpLL
z9aW;e;~Gu|Aq^{%$*W9LIAIxB(hF|(j>SLvg^!M=gak9MV$+D@}+
zoNBeY9gdpy`G{)oT!!0-ub<`$J{WmbZ+Z3SWvatK-PzXtrtn^Yi48`O;!O%=ra{sn
zU=bk-#2O0?a_W~FvS3r%C`vW6mQefM(>ripSR7oqRc<>KgU-SI^SEf#5VsJ!Zh
z$xAw+TS_^JCHk04=D+U|6-y$Em!15}huk+pZrXmwyKBO&#AIt}ZQ<54=@uk75mh0V
zzpMnGMQ{>SQ<7%uS#->z5WP*s#lSJf8zlfC>@*La(&;~1LXEwSO1B6a*DfJ!O**Hj
z22Ruurlh10xGz5goDI@HWgRwn$KpwBjWjSb`T9WFcJ4~x`SyDWPE6w`FFso_@mz12
z{Bma`aFOq`;B7)@&7Ws$j_)k?SL9t>pE;CGumlv-0eDwN$0FYyz(Fk@qZ_w!D)>Ce
z?Py7if%Xs%Jhw%^w!!w|#&T={BkYd_6ow{b&sz7BPLDABlYJ!cpl>^k0y?u|ehsl0D0*M50`d22ti9DF$=XIaYkE{Kn0jg*NYgB+pz7NO>L_EBaCE
z)q)jbu>-g!vjS!aMs4ccC+ecepDvt-JAOXw&dTHVs^_UT9al+!2RMPUP_gRv;az_o
zs=%XZr8qX0@U_7M_>E%H76q0u1#dU(MpVOGBS
zMPMD<&KbWHVVtnXrqLL6wD)YB1=6ed-6lo7Vom~=(m4hwnAB;PKew)D+
z>rm#@N$x?pA5sMC-Xm!HgR2RQZlkaw@MPyOiWC_C4*<7|Gqt#n!}RU`TrFOXxVc~x
z3|}c`%w9N{!oME~k~#)?Jni?qgqxyfnM45h_Min=Kg3oXc^{Ds;m+F_?=8;4GwOXI
zV&52V;%_tAn)t<iwB4}9FLLM6l=9sWbAB-s{$;*ikcx)~Km#AC
z_gnr#g6gC_cJ3kl>xHtugDnX+$#im^x-z~Gw<&pQNJRB}Aga}XU8s?yZ6S8T`Shn-
zh~?GpsJfGV%n8DovdXfbr;zT=l|HdJ@Wh|qKK^3VchMu=!QlbHIx6`&{ETIgTKO6O
zF$2ThLN_F;NrSmfJXwH2HB{|;T5a@B8g*_y=w~nsT<|7S)q09bs*jc&n%Sb8;zb?X
zVqXW5(eOT@!t1Iqy|RioJw}TlO&Q<2HB8O}6IkUVifT1jSvW9Tgg{_Qjzf^A*)
zk&{RHXpgQ(l{EFFDYe5OnM4&~qREUYtjr-z4~+dSa9uMhygzU?1sPYi`Wca+63oo>
zzinR$$XZ4K_lU>5^f=S6jAu?zz$p?aB+btp=@IpJzs%2aeMaSv4D5b+y$if)&ihmR
zb5;MfU*k*-Js2v-Ir?bhxeE6u?1P-*%#Ht?wwe9^MB9VLl+$(Q76tefQkUwv;@kb?
zOW@47-A!B))Wlngks_a&iX@VMR@_nNZP9n{j?E3atgj-G;Ulg+T-QI0vpK?tpHe~)
zZ;=CEs3Ye`FJ~h8K(Nf7<(N=}ZB>%5ue)Mqk60n+
z0)CIU5x8Y@A?Ekdg@Q~3F?gNPKbkK|i`tTA;s!Sl!6{{mS-CRb=~uGIeqFvoj_sbR
zvWkLf=_>05z=C^|Jb7izu~U*zs&%MC#|6tRt1#2B9P^5b;dFo9dyyZSDz_BzL0CuM
zNZ$hwN6+K(tPi{XJ%1U)(t!BkAEoyOI7m?lVGw3ada2eoSaWsiZyW-9ZeK@t;~x3~
z-|xU%;@Zqtoe$%E-NvR0Q&W46Kpyuo+yL)+uv7wvijwdh=9sg$hHRWSrqU<3MKFKx
z`Qh7(aaA%3WkImC$#Zy16Rx*2>DUQ3tqKFcr3;iGJGopA4h{y4Bl9YHL(lH)LSgHn
zX9>)ZCwb%pjk`
zz~AAWMgH}^YUz7%C(AkOM<;t_H+riNS56*QA1_O{uy}7MDX6J_=Z-aB_9Wepn?B12
zLGO?ZPh!O?f@@!zX&R@HwFI(eS`-C$BclUdSIe_*v<4n}Jbr3ik!)O91)u6EV?Cm<
zavi6=004Ag+A`!9X^^Fd(Nq#dwD{o$tO%yNF
z_uRuJQW~%s?zYtzHeBg3(xsl&aJs;{gir+I$fm)8>(@Qg*ij5LJi5ljGsOQkn<8v2
zYCNExj!~}VN}~P0Tp-(-e6>C1OF~<>Yfvv7O84_#b&4P(;}4Eo(>zpBx|7x8hE`E~
z8?&v$quWBjofClsV;f`2_T$}VVhB59F8zan-4*S6u5##(^oEOx|1aIKv&vnt%j_Gh
zCt=t3Dz3aAHzkb~DyfbX=&E|nu}lk&Rg-p$HfJw2zh4Sf+Bs*e)F&%lVkoVB$aMBR
zko~FV`pIS7`et-&+WKbpD1u6EdUhkKH?JRX+OmZ`U!!Q3FX99ake8N%
zXF#Veh7YY*rZLkNV|+{f8;@sa-)r59WE=lPzaYRIEkY3nhww#&L38vE!l1X5ndp+M
z^(y_ios5Odh%`QtMKz$UwDu(G`VIE$HjFf0o%;d9xiTV&*~>V>PaRnknm`K$J@F$6
zTMo~>tqo${+9zXU<8WqXVI`oR6ASXMg%x=(SsEJ0r{3?aRSe?e*4|Q_agdAa$q!qu
zwoJeVN6=YJ=Y8anE9qWN)~-tO781$-Uf*FQ;CG=a#aWOa3Zza$W7
z@>m8(kw3>@m0Qhs+H!8k$yI#yHhDS~2r0__^4OZYvTcE5$YVs7+dN)QCF>+})_t~#
zlSPj=D=i~dFcY6`5Qf~s+DI7D`1elwNk5+4lsj@*uOu9LotD8dGCP(sF|*GXwDJ_f
z-V4C5H!z)nz2ghOVcpxtWy`)VHal<&14*jB!lhA26}ibwB8-+{Yq65TRtXn
z|Ni}{q<~xDp!MuM=5Y`}eIPQcVwzw1GAt}C6f{^D)fe2*{kie*hR@PXHgRN?
zZV+s-^YfvU)~>kH^$ap;%qYbe5GM>N&}hGCK;=G1VLdJ`Az>ADn0DZ`+5H@y|EW`q
z#6_xhZok^PTyh^Wy)=Y;@0>$#`>{re7iR({W#4K4rkWAAZ~JZdg%l4ExG|sUx{-KL
z|6|c@A8DF3;J3*xy{8~L{&B)5BD55I!@x9*c?|Sm&^fYX*(A
zbx|}c-+S8}&h{9|gY%`xRO7FBcZ-oR-0)<-pHO)e=TJB&HvnmAH944?{@_JGM)p_E
z2>vB-2}H97{IZ<+{nkzBEv2$In0dAn{8{3WDt!;yZawrw*FC`W_z`+?%A8(d#dB6%
z$)G!pvIBKAh-&tyxoKLI*R!074VoWK@-n4Cq@fO0f@yg}x~k7s&yQIj&*kgZ{B&Wb
zfjlsZzXxb79RgCGuZk}n|Kc4()TY_@1^M?^pY`SZJ=q&
zmwL_D0gMHi_*P{jDjE^4(^0*-(EP2bKeQWGsx^aKZTpg!iv82g6JGSz4!eoKY?1mq
zsXhrh$r~rC(VyJ%o;5C6$hRU;`SWY~CD7mdi^gn#3-{OQ$$NkkNQ>ex*yAVLxvZw!qxMF-D%2!Mkk0fhpkAnco<-RJO#{Si!As
zLfF_1+P#w07qNs|?xe{JyhnSordcn7Xsxg4apK$w%$F@KrznS6gq1R*k0q@*4)x6~
z_vPVNEFZ;tZOwgo?Fx+X$lPGq8Hj7|#8#rma{lLjZMt?qV=%|zI;D(fKFiuzw2sNo
zuiPI}iX+dfIS6`k!`%X^A3=}%c?CEchluUe(;I#x)0c&;hkjQZLb%9RsRYAgD*XOD|i5-VE-_
z|7w&qe@g=5I(#@VNLY#$w9Fm;@!#@_;qp<#zgcbT_c}bgeqUI+S_%68d7DO`Z66Mu_~w^{i{TCsGFg!%GCpm=|vy+y)cd6w_N+9u(0|U22$nTCU%*
zn}NB-VySa-I@kEZ!P;B5jhS{J7*Y;xFI-s}
zdR`dJf2YZqj;>fP4;okWWlR9KzbTK%d&X3f+*w!-L9qgP-0yP)E$owWKa4hT&x&^@
z=$fi5oeOveMm3F#(|j_FZ)?&)Vy4nIFP-&y5p+0Q+9a~#1a}H$isV0eQ|^ahLHk=T
z11cWmneN?sPGI4}T>HireK7#o6OpAXw^0
zMGK4Wr(A&@M8OZ>JtoRzG<0=s>xfuzPw-*BUPo@iymUD0*v-2PHW}p2otK$t@2}K-
zVtzK?60pBwpJ09xmP?i^R-_v40#X^EMm-rWu`Ox1>%BWpmSO|eo5(2xe$4YIGtKZO
z)twt&BAn|!^3RIX+Ng?x#hGkUb1w3lq4ceY6cCw=u8FPfVcU|={msn^g>>XU2kBEJ
zA<&rW^+=4)mJkr+GlhJ5dnCEO|4g-<`sC{g51YeECTPKyT?^Ch8~`7A_D;W2YVG&6
zzrz38WRQl%aIROFF}TN4_zqpTbO|o$Oa#U1;Z3S%z&7Fn<JNNWo2|&sq2M;c(s&o9p5<#?Q9*93qH#{c!X)1
z+vscoQ&#WWy4Kxn8zS_My#rTvn}%KG?nDp>>P^;nw_QSWR_@S9UA``6mE?``ZWJGV
zLwLph|3MxGo3x1;c)$Wq+Vp6>bgJAj_ru4D{G44H#JkU@+k8sfxdJOU5>~#o@>Y*<
z3CdTGjJgbOR#8Ac6@cu&p309@)&ypNW?mfsDGXR3<{?SZF3p`QxK^&fElD-rY}=2;
zGT@}j;O*(B`*kuu)Ua(qtq5$1KKSDgwwL&oYOeI%#*OBYwy^(XC519mS<2{ff(`K)
zI7X<-j(-?j@P71yZgiUEOJHR@A6S*yVJ|cdnYqj2b#!TIR{F$^#PUJjdbCpaujY^~
z%q!aGRYQk&gzkG5gE4N0dA+b>4xc#q)z+4IeNzeu>mRURY&@ua-7!Wkz@aN!R%8*4
zA79P0((?zl3r^=~0tD|BqhVOZ{&TNpL5HvMzi~+Vh2OqPT`3wyZJxz4C
z$aypC-9t@x?ZUx}6V=U?Y1xhJOaAzA&!>rMjk(pDU^waDbA6IZ`09nzG6S3Hg%oqQ
zeGZRfa5>h)#VW^psFOi1txiq`@1q6eJ{|afuA7JIiRG>0p@!|HwK8W@rtO-{{}l0G
ziw^WWs-`pNoH*O?%pi%@zV)}}HHQXi>!R}S#a?r=Ea5=kHwK=sF|zx8;~-`8yB+Tr
z^4f$F>9$mEA51Rabr(`teC}L_QZ3hM869lS^lFS*;zRNPVJ}W?3(*U&fPMBTjOgGB
z=DQqNmNGEd-MrD+oT8@Ik{LRwgdDtWbLzCH
zoE5ss9Y7(Ftq+tK&+}S&DwI3KS0oD4?E!m}BL!|D0H!wm-MCUXW3}{WLi7u{0w~|8
z?>n{p4hyoq#-npSU$Jqi!nmwrLX|;{9b*1r!9lfm3s;iC{>>WHX3(K}sBZUtvkI1>mk+ysIq0a9n-D$Dt`je{eD_xnZ(b
zFu@?kC?UQ7A4}E#90}Oi2Uy0X_%Qw*Sfa!vnU%&{=%QXJj`k#h?mstXxil7cc
z-|O}qn%-z?(ErlB$o5UtPDH@fGJ9)+H&OJ7vHWf=k
zIX}AXKjI`d+V}~s;s!OVpztvqFk5TU?NgQB0U?eO90+!L=oZ+_QeZFo45YL#!(A-X
zlI#lM#}tsR^Zx$)eqyONP8=Qbb~b!^okrb44NsKP%G`yU1a4PNRr_S;*}oTjbv(JF
z&vTNc0A7shJ;0*=hklakbmqM^sLvJ@49q@v8yI()#i53H6h0lQV|2J9c1XV(%wxNS
zkMo__o~I$r#isB%ddTGw3(DW1Sy)*68i!ZFgm^7vWte`f{rtMrK8Fgmck)*8L
zyt*ar%l5YuRE3Ym9%ckS)fWn%^|-rGcvSx|$I_x2El~)i`<~OX!_=Y^F&5vM1RRKh
z#()H=H_ADV?H~2dcqz_%2JWWznIEQB)tlcc`ivG)&pVFp-EtfD*(;nJ7Em&s^EJ62
z?$D#a-dyWPO-3{mg)a7pRorm;exDf%8s57yN>AS~SDlw}i?Kpgdj3=^uc(+7#JC0j
z?U%KGucL5zKp!E=ea@fgPbE0@!I<^z`M@~Dnyt@6cAG)2wO31%0xIz?QFtm*oG)kf
zg1yGmDYe-^E{h{nG*@fJbWx&^1Rta?3rx7StZ@fWuMW3AoUO_DqM-}^sK9ItC>Grv
zR?k=x8>+`RK&$d6!FqSs&tXZ+7CVzrY%_d!7y%(XVsU|}M_c1fa0
zzu0Qna;ep#=Fp&QyKc6{Zx*FJ(63SGa$izavZ4J$g~>t3ox(GhX_{ysE
zPA}expV^Bf{4$9ZR%j-cRyLL>qSj%g=hYC?;K;
zcH+s(Nh_6?-~$3=Kr}d4kL~Q}!5z1?YOhf$zX(5P(1P*aa;$ul)Wov&J<{5VtDDHMR95WMmq9{axuat9#V~WcEb1gXRQeH#YSLk|tmu(d
zfa0v?ym2K}hvK0tFEBgqSaUu)MDc5J^X#2e$26liZb_eENJp$(%
zkYPM&pv}`LBrVD#tZ384Dq;kSlRIpr0C0R>@sSmYm#Kw(IqmqdV$5D7ruTF~KN!*Y
zCPcWfNEWPn!l?Qcq)Sj-p5O_X?xo~^T;w_#Q-gf^2=X((_t=XDPzG^}chgmmwJYp;
z@)DeSY<>XB!tyC7b&f~%L8>lC`Oa}nYfIUs1e=oySSL?xWnwiLpOV&3xDc7B88i>0
zvSXJXrT&GE+ogh>QfZ|5$JeFnO>9wB)$u-QI=9gL*{dMa{=wkB0S;wn7k*1Cxdfso
z7?*jq==Few!T3)p0kx?~>Yz#NsV7Kx=-Ng$3XW^K^QmFt{9xEbfHb5#75xGG8c(Rb
zp1Y-s+*5R$O0o>4m*yPPVG4ageGeIyR-ab*t8eXHk)1=2b?xVT<
zfyzX~d1GOs5B`f$yXA#6pVbH7;YodaeU8a~8F3-VDW0h7)@G
ze|SiQ`JqcF%bE1SP^5zaku*}GQsI^To3yv(xLMSqW(OKt8fDxb)h-)^d6#)7R?^&c&*m7Lcf;{
z7E22sAf|$NtDzlUJHlql(fZESWyshK4jAUCVvq>2c%)R$pz~xD=}~gA|5O*r&Bawu
zov8e_bGD<-)F#&8-J;e25Sbc44EBvYrGdfWoXHo?MGT0CEy4hYm9tABf*cQEe5y5F
z!|Q>-uMA6cGcO0gG*Pqr4nSg8D_4OB?K_}kNPoT6OciRAY~`_Y;3&9?g(koYM201H
z-{Wb%(Y;>I@x~=qkF4c+)?MWnM&l{rgB$bq&dz0x;(x#WsuOpx`!w}QbmxIo`ycyi
zmWa51W5xt3-~i2>sV-zpYy*P=%PD3go{9%pZV9+ICEksCXVYn8x=6kFJ5
z5no4E)Ru*ZzL5_Rv{jd%H2V3tQ*TmNS3rDe26cs_L;!y;oNtG7Q
zK}Car(xoH4_g+0Js0dgn0z#w&q)Q1Mf<{0Sg{k`|S^N-~-
zli9QP>g&7K>i6I(A{n|GYR44q7M5d8twrY+`ayb|iS;>};1QoTrtdeA*W~R-whWmkCcbo7`)Bz
zFsY(QY3!{8scelgvXezi&MzH?$%vFNyaAH2b;{;&5r3SckJnnzeeC-o`3D8-y_fna
z^?_?(9Le(2{=xm;3B{7KemmP{BLp35QTY6V);yTv
zd(NoroIVr9Jxj9vRI*L2$;502&Ye{QEs^DuWi?&jT!z&R1|`OBpgLB+by$|*
zH$bR1UU2l+pNE&X73STK9`sErlGG>56q0kx9Mb{5O+O;srRf6aS_
zZ$_uaahBAM^PDL8YW9=%b$(+uupXdneu~_r3^;Q3bcRXv49&E@`0@ZQTE7tpePGrf
z$_JHL2km1*+l6yKpdFIz`u!4|T&C^Q_-6Kn#2panSSD8A2Gc^ps9o~9^q#5lRO!99
zN#q-xm+Om7riz|35`BXPrli_B+LGfx;?xBwuwfFwhm@ZneDQbX*oTt2+6fzp*Ujyn
zZ%)T8zG+_>&N;oMik371cTIg;(=LCdpL))A@t|JxPXHzJtsm^m)QPSRn$^d5k#vKu
zEee(x58Eb{U-nWVmG=)!hG@aZqAv{n-x17Iy1U->
z(#dlt+>!KwE%A7~wn+aKOn`_mX4edtvh{xL27t9XuZ$=$K3j}!w9@U4e;!+wkTa=r
z59~0pA>)RMGGU*%K|OjBWu!_yb7vMRH5CsSerPZMzYkvo;k)_&sv&OM?+4?$F2x8lN)9@U`B($@TkyA2zw
z`+pL&nQu4H45C}S$LXDu@6A2u#lIEPmusY7^-F}zJnk-dE80sL1xB2IAhqCgf-2IS
zmB_Nu$UhCNrGRA6k)%)9@bh0OQa9jlYo|6o+{sPu?)^CMPb&`emVNcDdEg4UzXz%jx(K4tuCM4DO#$Fy;O*N>c8b{Fwjfr
zi3q6L#Zc(XZ~oc}6$scXpve-~j@U&UkPKjb*?JRp{E5T^L18|UO|$U`c4#ioY++#-_ZcL$n_!jaSTXBS4y^C}e{->{4v*anRsAlHv(U*yb-UuFg3p@7j
zUpHScu|#~eAK~F^3`QJkjROpj
zPP*0XUgR15YO^PtUhGnsZTIjcyckGtS)_4JM~hU57247tLuTX?ngO&Qgaisy0f
z#{(`~c-`|Mt?R-AW$5jUHFaFvZjUP!*P*EyGl1ODBp+Q;iXZbC0md07{alhb=0n~J
zje!qmJYf~}g|Dhr*&(Mlbl1o>4KlZyZ;Yvjw7~buIZL)b!l?sG^$RsswJIj??n#Sa
zVGQZrwsNVNv1m1MF*vevv7fom4K2E^9Gzyog*BYR%5M}DJnUYqjOBY(Xn)d+Pl-iCrLOFH+TI+2EF&fL
z)~%5`6GA57KdbS0SGSs*3g_zTCs2zNEa2BM1|>&T%j0p5f3Gw}-&8O@J}#etdtLH9
z@%}XlRF+cv!N(C|vm~jg3?x9SHWWzBcsxMbi0*Zgw734MrjLY&jyFHph)e&d5x$<}
zJ>>H?#bPqJLVXRS?lT=O<
z!;eQspPB4wbXG?&s))k$-;MFHnmk$60uE!%5H?tZ
zRb}0jv0FsggPJeHe57Ktx-t`3#NSsM7M?uUYp-Qw$_qNYZd!3Cbhm~FS|H#JLZ~WD
zluv`FbIGg0MY!I$K&imv@b6)P9oaXllkEH#?v`{hgJwRF#9JT@v;GuSUSRfdf8OO&
ztt#B%=!~z(f_VJ%6q^O74GJ
zw&}fKp?M{y2v)KIw_=tFd9&D{3ODi6*6?fDjqnu;GkKl5J%6i|zuH=nGJ+0LZd`8H
z37WXI0tN?ST9Rq@0hxP`Uis~?z9(;nm|D;N_!gqLMu4|n0S%L&HX}rYn$YVT%7W<@
z!nxA=Up?S2JzpV9k|q=4$3Ev&EWB7U@;MW#c>@LJkn$xPQLd-#Ni|l)FQ$l~@;p^I
zU@oAWei}PlmA@=@f;8v*b8YT}%QwvKxR(8dYwupc$%XEJ3Ck#qf`!B%vbpq)6iyY;
zw#VNNVw_wo)Zv|vi>Zy7VaBpxTENo-PRX^*j#`KQNn+FLzpIE7<)=IsM#9Vt^w0DcZ5g3<23!h#2
z@8Mqacp4_!No