XSOAR 8 Commercial SaaS/ Govt Cloud to Microsoft Sentinel GCC High Integration

[neha.khan366]

Hi everyone,

I am evaluating the integration between Cortex XSOAR 8 (Commercial SaaS / Government Cloud) and Microsoft Sentinel, which is deployed within a GCC High environment. I have the following queries:

1. CONNECTIVITY
I noticed that the Microsoft Sentinel integration in XSOAR provides a "US GCC-High" option under the Azure Cloud dropdown. Can I leverage this to connect Cortex XSOAR 8 (Commercial SaaS / Government Cloud) tenant directly to GCC High Sentinel, without the need to deploy an XSOAR engine? If yes, could you please provide details on:
• Communication flow and architecture
• Protocols and ports used
• Authentication mechanism

2. BEST APPROACH
My current plan is to use the Microsoft Sentinel integration to fetch incidents from Sentinel into XSOAR 8 (Commercial SaaS / Government Cloud). Has anyone implemented this architecture? If so, could you share experience or the recommended approach?

Thank you for your support.

[amelia854taylor]

Yes, you can connect Cortex XSOAR 8 SaaS directly to Microsoft Sentinel GCC High using the “US GCC‑High” option, without an engine. Communication is over HTTPS (TCP 443), authenticated via Azure App Registration (client ID/secret or certificate) with Sentinel Contributor role. Best practice is to fetch incidents into XSOAR and run playbooks there, keeping Sentinel as the SIEM and XSOAR as the automation layer.