Identity Settings

Identity Settings is where you configure your monitored domains, view the identity module integration health, and configure your posture check preferences.

Integrations tab

The Integrations section is where you set up your identity provider integrations for ITDR. For more information, see ITDR integration guide.

If you've already completed the setup, the Configured Integrations section lists the identity provider integrations that ITDR uses to collect data and run security assessments against your Microsoft Entra ID and on-premises Active Directory environments. Expand the Microsoft Entra ID integration to see its child integrations and their health status.

Integration health

Each integration reports a health status. When an integration is unhealthy, ITDR shows the reasons why and a recommended action for each one.

Status	Meaning
Healthy	The integration is connected and collecting data.
Pending	The integration is still being set up, or is waiting for its first data. Health isn't verified yet.
Unhealthy	The integration has an issue and isn't collecting data, or is only collecting part of it.
Provisioning Failed	The integration had a critical issue during setup and isn't collecting data.

Select the health status of an integration to open the health details. The details list every reason that currently applies to the integration, with a recommended action for each one.

An integration can have more than one reason at the same time. Each reason is shown separately with its own action.
Reasons that affect health are listed first. Informational reasons are listed last.
An informational reason doesn't change the health status. An integration can show as Healthy and still list an informational reason.
For Microsoft Entra ID, the integration shows the most severe health status of its child integrations. For example, it shows as Unhealthy if any child integration is unhealthy.

Microsoft Entra ID health reasons

Reason	What it means	Affects health	Recommended action
ITDR application consent required	Required application permissions haven't been granted to the ITDR application in Microsoft Entra ID. Some data and posture checks are unavailable until consent is granted.	Yes	Select Grant Admin Consent and sign in as a Microsoft Entra ID administrator to grant the missing permissions.
Provider is misconfigured	None of the integration's child integrations are working.	Yes	Select Remove and reconfigure integration. If the issue persists, contact support.
Child integration (name) is unhealthy	The named child integration isn't working or couldn't be set up. Other child integrations continue to collect data.	Yes	Contact support and include the child integration name.
Child integration (name) requires a license	The named child integration needs a Microsoft license that was not found in your connected directory. This data isn't collected, but the rest of the integration is unaffected.	No	To collect this data, add the Microsoft license listed for that child integration in Microsoft license requirements. No action is needed otherwise.

On-premises Active Directory health reasons

Reason	What it mans	Affects health	Recommended action
Directory source is unhealthy	A directory source for one of your monitored domains isn't working correctly. Some identity data may be incomplete.	Yes	Check that the ITDR sensor service is running on the host server and has outbound connectivity. See Verify the integration. If the issue persists, contact support.
No data received	ITDR is waiting for the first data from a directory source. This is expected shortly after setup.	Yes	Wait for the first sync to finish. If no data arrives, check that the ITDR sensor is installed, running, and can reach Sophos cloud services.
Directory source is disabled	A directory source for one of your monitored domains is disabled and cannot sync data.	No	Contact support if you need help re-enabling the directory source.
Provider is misconfigured	The selected directory sources don't match the available directory source configuration, for example no domain is configured.	Yes	Select Remove and reconfigure integration. If the issue persists, contact support.

Tip

If an integration shows as Unhealthy with the reason Unhealthy reasons unavailable, contact support. Not every condition has a specific reason yet.

Note

When you contact support, include the integration name, the reason title, and, for a child integration, the child integration name shown in the health details.

Why does my healthy integration still show a reason?

Some reasons are informational. They tell you about data that isn't being collected, such as data that needs an extra Microsoft license, but they don't affect the health status.

I fixed the issue. Why does the integration still show as Unhealthy?

Health is re-evaluated periodically. After you grant admin consent or fix a connection issue, the status can take some time to update.

Microsoft license requirements

ITDR requires Microsoft Entra ID P1 or P2. Other Microsoft licenses are optional. ITDR doesn't enforce them, it collects whatever data your Microsoft licenses make available. When you have higher-tier Microsoft licenses, ITDR can collect more data and surface more detections and posture checks.

The child integrations below match the names shown under Configured Integrations. In the console, some names end with (Identity XDR).

Child integrations	Used for	Microsoft license	Required or optional
Entra IDR Ingest Users, Groups, Applications, Devices, Domains, Service Principals, and OAuth2 Permission Grants	Identity and directory inventory, such as accounts, group membership, applications, and consent grants.	Microsoft Entra ID P1 or P2	Required
Entra IDR Ingest MFA Report, User Report, Conditional Access Policies, and Named Locations	MFA registration, last sign-in activity, and Conditional Access posture. See Conditional Access license requirements.	Microsoft Entra ID P1 or P2	Required
Microsoft GraphAudit Interactive Sign-In, Non-Interactive Sign-In, Service Principal Sign-In, Managed Identity Sign-In, and Directory	Sign-in and directory audit activity used for detections. See Sign-in logs and Audit logs.	Microsoft Entra ID P1 or P2	Required
Microsoft Entra Risk Detections	User risk signals from Microsoft Entra ID Protection. With P1, non-premium risk detections are collected. P2 adds premium risk detections. See What are risk detections?.	Microsoft Entra ID P1 (non-premium) or P2 (premium)	Required: P1 Optional: P2
Microsoft Entra Service Principal Risk Detections	Extends risk information and detections for service principals (workload identities). See Securing workload identities.	Microsoft Entra Workload ID Premium	Optional
Microsoft Entra Agent Risk Detections	Risk signals for AI agent identities. See ID Protection for agents licensing.	Microsoft Entra ID P2 and Microsoft Agent 365. Microsoft 365 E7 includes both.	Optional
Entra IDR Ingest Managed Devices and Intune Role Assignments	Intune device and role posture.	Microsoft Intune	Optional
Office 365 Audit AzureActiveDirectory, Office 365 Audit Exchange, Office 365 Audit General, Office 365 Audit SharePoint, and Office 365 DLP All	Microsoft 365 activity and data loss prevention events. Audit logging must be turned on. See Turn auditing on or off.	Microsoft 365 subscription	Optional

ITDR detects licenses in the connected Microsoft directory whether they are purchased on their own or as part of a bundle, such as Microsoft 365 E3, E5, or Business Premium.

Note

A missing optional license is shown as the informational reason "Child integration (name) requires a license" and doesn't affect health. If a child integration shows as Unhealthy, check the reason shown in the health details and admin consent, then contact support if the issue continues.

I added a Microsoft license. Why is the child integration still not collecting data?

Microsoft can take time to make licensed data available after a license change. We've seen delays of up to a week. Health and license status are re-evaluated periodically, so the child integration updates after Microsoft makes the data available.

Disable integration

To disable the integration and posture checks for an identity provider, turn off the toggle in the Status column and confirm your action.

Edit integration

To edit the integration configuration, click the Edit icon in the Actions column.

Delete integration

To delete the integration and remove the identity provider and all findings, click the three dots in the Actions column, click Delete Integration, and confirm your action.

Warning

This action can't be undone.

Dark Web Monitoring tab

In the Dark Web Monitoring tab, you can set which primary domains are monitored for credential leaks and configure users for VIP monitoring.

Domains

The Domains section lists every domain available for credential leak monitoring. A domain is added to this list in one of two ways:

Automatically collected: Synced from your Microsoft Entra ID tenant. These domains sync every 24 hours and don't show in the Domains section immediately after initial ITDR setup.
Manually added: Entered directly by an administrator. Because ownership of a manually-added domain isn't already established by a provider sync, it must be verified with a DNS TXT record before it can be monitored. This is currently the only way to add domains for an on-premises Active Directory environment.

See the following domain status meanings:

Status	Meaning
Verified	Domain ownership is established, either automatically for synced domains, or after DNS TXT verification for manually-added domains. Monitoring can be turned on.
Pending	Domain has not been verified yet. Monitoring is unavailable and no leak data is collected for the domain until it's verified.

Turn monitoring on or off

For a Verified domain, use the Monitored column to turn credential leak monitoring on or off for that domain.

Note

The Monitored is turned off for Pending domains. Verify the domain first by following the steps below.

Add and verify a domain

To manually add a domain that wasn't automatically collected from your identity provider sync, do as follows:

Click Add domain.
Enter the domain name and click Add.
In the Domain verification setup panel, copy the Record Name and Value for the generated TXT record using the Copy icon next to each field.
Add the TXT record to your domain's DNS provider.

Note

It can take up to 24 hours for DNS changes to propagate.
When the record is live, click Verify.

If verification succeeds, the domain's status changes to Verified and monitoring becomes available for it. If verification fails, a message tells you to confirm the TXT record and wait for DNS propagation before trying again. Click the Retry icon in the domain's Actions column to reopen the verification panel and try again without re-entering the domain.

Delete a domain

To remove a manually-added domain, click the Delete icon in the Actions column and confirm. Deleting a domain that is currently monitored also stops monitoring for it.

Note

Automatically-collected domains don't have a delete action. They're managed by your identity provider sync.

Select users for VIP monitoring

The VIP Monitored Users section lets you select users that you consider very important. The users you select have a VIP tag throughout ITDR to signify their VIP status. VIP monitoring focuses on identifying business-related leaks, mentions, or campaigns against users that include personal email addresses, phone numbers, or social media accounts.

Configuring a user for VIP monitoring is also a profile factor for that identity's Risk Score. VIP-monitored identities are treated as higher-value targets and score higher accordingly. For details, see Identity Risk Score.

Note

VIP monitoring isn't a replacement for personal identity monitoring solutions. VIP monitoring focuses on identifying potential business-related leaks, mentions, or campaigns that target users' personal emails, phone numbers, and social media accounts, or that could allow bypass attacks.

To select a user for VIP monitoring, do as follows:

Click Add User.
In Configure VIP Monitoring, click the Name menu and select a user.
Define the attributes that you want to monitor as follows:
- Enter email addresses to be monitored, such as personal email addresses. Click the Plus icon next to Email to add a maximum of five addresses.
- Enter a primary and secondary phone number. Click the Plus icon to add a maximum of five numbers.
- Enter a zip code.
- Enter a social media username. Click the Plus icon to add a maximum of five usernames.
Click Configure.

When you configure a user, we monitor the dark web for the user's attributes along with company names and domains to identify potential business leaks or mentions within the past year.

To edit a VIP user's attributes or delete a user's VIP status, click the Pencil icon or Delete icon in the VIP Monitored Users section.

Posture Check Preferences tab

In the Posture Check Preferences section, you can turn posture checks used by ITDR on or off and view their details. All posture checks are turned on by default.

The table shows the following information:

The title, category, provider type, tags, published date, last modified date, and status for each check.
A New badge next to the title for checks published in the last seven days.
Tags shown as chips. If a check has multiple tags, additional tags collapse into a +N chip. Hover over the +N chip to see all tags.

Find posture checks

Use the following actions to find specific checks:

Search: Enter text in the search box to filter checks by title.
Filter: Filter by Category, Tags, Status, Provider Type, Auto Resolution Disabled status, Published at date range, or Last modified date range. Some filters are expanded by default. Click the up or down arrow on the right of the filter name to expand or collapse the filter.
Sort: Click the Title, Category, Published, or Last Modified column header to sort the table by that column.

The counter above the table shows how many checks match your current filters. Click the X on a filter chip to remove it, or click Clear All to reset the table.

View posture check details

Click a title in the table to open the details panel, which shows the check description, risk narrative, details, recommendations, and references. Use the previous and next arrows to move between checks.

Customize posture checks

Click the toggle in the Status column or the details panel to turn a posture check on or off. For disabled checks, the details panel shows who last turned it off and when.