Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/central/customer/help/en-us/index.html?contextId=identity-detection

ITDR

Sophos ITDR (Identity Threat Detection and Response) is software that helps improve your security posture by continuously monitoring for identity risks and misconfigurations, while providing dark web intelligence on compromised credentials. With ITDR, you receive a list of prioritized findings and an Identity Risk Posture score based on your current exposures within minutes of setup.

Note

For details about the Sophos Fusion data regions that support ITDR, see Available Sophos products per region.

To see ITDR, sign in to Sophos Fusion and go to My Products > Identity.

What is an identity?

An identity is a collection of unique identifiers that allow a computer to identify an entity, such as a person, organization, software program, or another computer.

ITDR includes the following active identities:

  • Human identities: Represent users, such as employees, guests, or vendors.
  • Machine or non-human identities (NHI): Represent entities such as applications, service principals, service accounts, machines, and any other identities that are used to authenticate and authorize access to resources or perform transactions between systems.

For more information, see Directory.

How is ITDR licensed?

ITDR is licensed per user. ITDR is sized on its own billable user count, which can differ from your Sophos XDR or MDR user count.

A user is billable when all of the following conditions are true:

  • The account is enabled in your identity provider (Microsoft Entra ID or on-premises Active Directory).
  • The account is not a guest (B2B) account.
  • The account has signed in within the last 90 days.

Users are counted across directories as follows:

  • The count is based on the identity providers you have connected to ITDR.
  • If you connect both Microsoft Entra ID and on-premises Active Directory, ITDR uses the Microsoft Entra ID user count, so synced accounts are not counted twice.
  • If you connect more than one Microsoft Entra ID tenant, each tenant is counted separately and the totals are added together. For example, if Tenant A (contoso.com) has 700 billable users and Tenant B (fabrikam.com) has 300 billable users, your billable user count is 1,000.
Are contractors and external users counted?

Guest (B2B) users within Entra ID are not counted. External people with their own member accounts, such as contractors, are counted if they are enabled and have signed in within the last 90 days.

Do users need an email address to be counted?

No. Any account that meets the billable criteria contained within the identity provider is counted. For example, accounts within Active Directory don't require an e-mail address.

Can I use the total number of accounts in my directory?

No. Directory totals include guests, disabled accounts, and inactive accounts, so they usually overstate the billable count. Use the billable user count shown in ITDR.

How does my Microsoft Entra ID license affect the count?

Your Microsoft license tier doesn't decide whether a user is billable. ITDR requires Microsoft Entra ID P1 or P2. A billable user doesn't mean every Microsoft data source or posture check is available. See Microsoft license requirements.

What are findings?

A finding is the output of a posture check performed by ITDR. Findings have an associated risk level that you use to prioritize which to address first. Find an overview of the top findings with the highest risk on the Identity Overview page, a full table of findings on the Findings page, and findings related to a specific identity on Identity Details pages. For more information, see Findings.

Optional Microsoft licenses let ITDR collect more data, such as Service Principal Risk Detections and Agent Risk Detections. See Microsoft license requirements.

Configure ITDR

After your ITDR license has been activated, click My Products > Identity > Settings to start configuring the identity provider integration. Follow the steps within the interface to complete the integration and begin using ITDR. For integration setup instructions, see ITDR integration guide.