Configure Entra ID for AP6 authentication

Sophos Central Wireless supports Microsoft Entra ID as an identity provider (IdP) for AP6 SSIDs that use enterprise encryption.

Prerequisites

Before configuring Entra ID for AP6 authentication, make sure your devices meet the following requirements and that you're not using unsupported features.

• EAP method: Only EAP-TTLS with PAP inner authentication is supported.

• Device compatibility: Windows and Android devices don't support TTLS/PAP with WPA3 enterprise, so the SSID must have the Encryption mode set to WPA2/WPA3 Enterprise.

  Apple devices must have a wireless configuration profile with the following settings installed:

  • EAP method: TTLS
  • Inner authentication: PAP

  Tip

  You can use Apple Configurator to create and install the profile. See Apple Configurator Support.

• Unsupported features: You can't use Sophos Central RADIUS authentication for the following features:

  • RADIUS-assigned VLAN
  • RADIUS accounting
  • Captive Portal authentication

Create the Entra ID application

You must create an application in Entra ID so that Sophos Central can authenticate users.

1. Sign in to the Microsoft Entra admin center.
2. Go to Entra ID > App registrations.

3. Click New registration.

   

4. Enter a Name.

5. Select Single tenant only for Supported account types.
6. Leave Redirect URI blank unless required in your environment.

7. Click Register.

   

Get the application details

After you create the application, you must copy the credentials so that you can enter them into Sophos Central when you add Entra ID as an external IdP.

1. In the Microsoft Entra admin center, go to Entra ID > App registrations and select your app.
2. Click Overview.

3. Note the Application (client) ID and Directory (tenant) ID. You'll need both these values in Sophos Central.

   

4. In your app, go to Certificates & secrets > Client secrets > New client secret.

5. Enter a description.
6. For Expires, select how long the secret will be valid for.

7. Click Add.

   

8. Click the Copy to clipboard button to copy the secret.

   Warning

   You must copy the secret when it's created. You can't see it again. If you lose the secret, you must create a new one.

   

9. Go to Entra ID > Domain names > Custom domain names.

10. Make a note of the Name and make sure the Status is Verified.

    

    You now have the Client ID, Client secret, Domain name, and Tenant ID needed in Sophos Central.

Set the application permissions

Set the Entra ID permissions as follows, so that Sophos Central can authenticate users:

1. In the Microsoft Entra admin center, go to Entra ID > App registrations and select your app.
2. Go to API permissions > Add a permission > Microsoft Graph.

3. Set the following permissions:

   Permission	Type	Admin consent required
   Directory.Read.All	Application	Yes
   User.Read	Delegated	Yes

   Tip

   Use the search feature to quickly find the permissions.

4. Click Add permissions.

   

5. Click Grant admin consent for <tenant>.

6. Click Yes.

   

   Both permissions now show as Granted.

   

Next steps

Entra ID is now configured for Sophos Central RADIUS authentication. To add Entra ID as an external identity provider for AP6 SSIDs, see Add a RADIUS server or identity provider.