Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/central/customer/help/en-us/index.html?contextId=identity-detection-integration

ITDR integration guide

After ITDR has been enabled on your tenant, click My Products > Identity > Settings from the navigation menu to start integrating with Microsoft Entra ID. You must have the Administrator role to perform this setup.

Set up the Entra ID integration

  1. In Sophos Central, go to Identity > Settings > Integrations.

  2. Click Set Up on the EntraID Integration card.

    Set up integration.

  3. Enter a name for the integration and click Next.

    Name the integration.

  4. If you want to enable response actions, select the checkbox. You can also configure response actions later.

    Choose to enable response actions.

  5. Click Authorize to be returned to Microsoft's identity provider to grant access.

  6. Sign in with a user account that lets you grant organization-wide consent for integration with the Entra ID tenant. Then approve the listed permissions to give ITDR access to Entra ID. For more information, see the Microsoft documentation.
  7. When the consent process is successful, you're returned to Sophos ITDR.
  8. Click View Identity Risk Posture to return to the ITDR Overview Dashboard.

Note

Depending on the size of your tenant, it may take a few minutes to start seeing data.

Set up response actions

You can optionally follow these steps if you didn't configure the response actions during initial setup:

  1. In Sophos Central, go to Identity > Settings > Integrations.
  2. Click Set Up on the Response Actions card.
  3. Click a currently configured Integration from the menu.
  4. Click Authorize to be returned to Microsoft's identity provider to grant access.
  5. Sign in with a user account that lets you grant organization-wide consent for integration with the Entra ID tenant. Then approve the listed permissions to give ITDR access to Entra ID. For more information, see the Microsoft documentation.
  6. When setup is complete, click Close.

When configured, response actions are available within the Actions menu throughout the Sophos ITDR application.