> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/connect/connect-cloud-accounts/onboard-your-oci-account/add-oci-tenant-to-prisma-cloud.md).

# Add Your OCI Tenant to Prisma Cloud

Your OCI tenant has a root compartment (tenancy) by default. To onboard your OCI tenant, you will need the root compartment’s OCID.

You must onboard OCI at the tenant level and any child compartments will be automatically onboarded on Prisma Cloud.

Each OCI tenant is associated with a Home region. Prisma Cloud is available for visibility and monitoring of your OCI tenants in all OCI-supported [cloud regions](https://docs.oracle.com/en-us/iaas/Content/General/Concepts/regions.htm).

1. **Get Started**.
   1. [Access Prisma Cloud](/content-collections/get-started/access-prisma-cloud.md).
   2. Select **Settings > Providers > Connect Provider and choose \*Cloud Account**.
   3. Select **Oracle Cloud** as the cloud account you want to onboard.
   4. Select **Tenant** under **Scope**.
   5. The **Misconfigurations** (Foundational capability) is enabled by default. It scans cloud resources and ingestion metadata for vulnerabilities.
   6. Click **Next**.

      <figure><img src="/files/XbB2XJhEnGZFYKYPMF0Q" alt="oci onboarding get started"><figcaption></figcaption></figure>
2. **Configure Account**.
   1. Enter a **Account Name** that uniquely identifies your OCI tenant on Prisma Cloud and click **Next**.
   2. Enter **Tenant/Root OCID**.

      In OCI, administrator resources are only created at the tenant level. To ingest those resources, you must first onboard the OCI tenant in Prisma Cloud by entering the root compartment OCID and home region from the OCI console.

      1. Log in to your OCI console and select **Identity & Security > Identity > Compartments**.
      2. Copy the **OCID** of the root compartment.

         <figure><img src="/files/2Iddu4FLzTdyKIiHWt6D" alt="oci tenant console 1"><figcaption></figcaption></figure>
      3. Return to the Prisma Cloud Onboarding Setup page and paste the OCID in the **Tenant/Root OCID** field.
   3. Select the **Home Region** where the tenant is created (for example, us-phoenix-1).
   4. Follow the next step **Create a User to Enable Access**, to create a new user, group, and policy that correspond to OCI Identity User Name, Group Name, and Policy Name.

      You can use an existing user with the correct privileges, an existing group, and an existing policy with the correct policy statements. However, it is recommended that you create a new user, group, and policy as described in the next step **Create a User to Enable Access**.
   5. **Create a User to Enable Access**

      Use the Terraform template to generate a new user OCID. The User Name, Group Name, and Policy Name must be unique and should not be present in your OCI tenant.

      1. **Download the terraform script** to your local machine.

         To onboard the Oracle Cloud account, a public key is needed to access the OCI API. This public key is embedded in the Terraform template, and it changes each time you download the template. Therefore, when creating a stack, make sure to use the most recent Terraform file that you downloaded.

         <figure><img src="/files/3QMS6Mht5ByiPJzr0JeL" alt="oci onboard config account"><figcaption></figcaption></figure>
      2. Check the OCI console to see if the **Primary email address required** checkbox is disabled.

         To ensure that the Terraform file runs successfully, uncheck the **Primary email address required** checkbox.

         1. Log in to your OCI tenant console.
         2. Navigate to **Identity > Domains > Default Domain > Settings > Domain Settings**.
         3. Disable the **Primary email address required** checkbox if it is enabled.

            <figure><img src="/files/40T4LrvZa5crBOGtq061" alt="oci uncheck primary email address reqd"><figcaption></figcaption></figure>
         4. **Save changes**.

            If you want to keep the **Primary email address required** checkbox enabled on your console, add your OCI tenant administrator’s email address to the userinput:\[oci identity user] email field in the Terraform file before running it.

            ```
            resource "oci_identity_user" "user" {
            name           = "oci_user_name_param"
            description    = "user created by terraform"
            email          = "<oci-tenant-administrator-email-address>"
            compartment_id = "oci_tenant_id_param"
            }
            ```
      3. Follow these steps to **Generate User OCID**
         1. Select the Home Region you entered in **Add Tenant Details** (for example, US West (Phoenix)).
         2. Navigate to **Developer Services > Resource Manager > Stacks** and select **Create Stack**.
         3. Select **My Configuration** to upload the Terraform configuration files.
         4. Under **Stack Configuration**, select **.Zip file** and upload the **terraform.tf.zip** file that you had previously downloaded to your local machine.
         5. Enter a stack **Name**, for example, PrismaCloudApp.
         6. Under **Create in compartment**, choose the **root** compartment if it is not already selected, and click **Next**.

            <figure><img src="/files/C6Wa58F5minCoQTdxUBa" alt="oci tenant console 2"><figcaption></figcaption></figure>
         7. The Configure variables have already been set. Click **Next**.

            <figure><img src="/files/FV628LGQX2fkth3TLs8B" alt="oci tenant console 3"><figcaption></figcaption></figure>
         8. Review the Stack information, select **Run apply** and **Create** the stack.

            The Terraform file gets executed, and the User OCID is generated.

            <figure><img src="/files/6qcABbvG8pj2L54R8rOI" alt="oci tenant console 4"><figcaption></figcaption></figure>
         9. From the current Job details, navigate to **Resources > Outputs** and copy the user\_ocid **Value**.

            <figure><img src="/files/J9JEvPdeOE6HrdmT12iI" alt="oci tenant console 6"><figcaption></figcaption></figure>
   6. Return to the Prisma Cloud Onboarding Setup page and paste the **User OCID** value in the User OCID text field.
   7. **Account Group Selection**

      Select the [Account Groups](/content-collections/administration/create-manage-account-groups.md) to associate with your OCI tenant and click **Next**.

      You must assign each cloud account to an account group, and [create an alert rule](/content-collections/alerts/create-an-alert-rule-cloud-infrastructure.md) to associate the account group with it to generate alerts when a policy violation occurs.

      <figure><img src="/files/3QMS6Mht5ByiPJzr0JeL" alt="oci onboard config account"><figcaption></figcaption></figure>
3. **Review Status**.
   1. Ensure that all the account details and the misconfiguration security capability display a green **Successful** or **Enabled** checkmark.

      The status check verifies the OCI tenant and the number of compartments available under that tenant. Prisma Cloud ingests the child compartment(s) along with the root tenant.
   2. Click **Save and Close** to complete onboarding or **Save and Onboard Another Account**.

      You can view the newly onboarded Oracle Cloud account on the **Cloud Accounts** page.

      <figure><img src="/files/Fts8ggg8le7z8JRSCRy3" alt="oci onboard verify 1"><figcaption></figcaption></figure>
   3. If an onboarded account displays a yellow or red status, you can either reload or refresh the cloud account and it’s associated security capabilities. Select **Home > Settings > Providers > Cloud Accounts** and click on the **Status** of the cloud account you want to refresh. Next, select the refresh button on the **Status** window to reload your cloud account.
4. **Next Steps**
   1. It can take up to an hour for the ingestion to complete after which you can view the resources in Prisma Cloud, review, and act on the alerts generated.
   2. Configure [Alert Rule](/content-collections/alerts/create-an-alert-rule-cloud-infrastructure.md) to include OCI policies.
   3. On the Prisma Cloud **Dashboard**, you can filter by OCI **Cloud Accounts**. Prisma Cloud supports only configuration ingestion for OCI tenants and displays only the relevant configuration ingestion data.

      <figure><img src="/files/Yfq2DS7Fl23rFD2G1QfX" alt="oci pc dashboard 1"><figcaption></figcaption></figure>
   4. Start using the Prisma Cloud [Asset Inventory](/content-collections/cloud-and-software-inventory/asset-inventory.md) for visibility. Set the **Cloud Type** filter as OCI to view the data for the supported services. You can also filter the data based on the OCI **Cloud Region** and **Service Name**.

      <figure><img src="/files/PEMCoalctSu8wop36YSY" alt="oci pc asset inv 1"><figcaption></figcaption></figure>
   5. To verify if the configuration logs for your OCI-related resources have been analyzed, you can run a query on the **Investigate** page.

      <figure><img src="/files/HFGYIVk5xrhgxFKSO8h4" alt="oci investigate darwin"><figcaption></figcaption></figure>
   6. Review the Prisma Cloud default **Policies** for OCI.

      Select **Governance > Overview**, set the **Cloud Type** filter as **OCI**, and view all the Config policies that are available to detect any misconfigurations in your infrastructure.

      <figure><img src="/files/cITktE028ETVIoLwi6Ay" alt="oci pc policy 1"><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/content-collections/connect/connect-cloud-accounts/onboard-your-oci-account/add-oci-tenant-to-prisma-cloud.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.