Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/nsg/sophos-firewall/23.0/Help/en-us/webhelp/onlinehelp/index.html?contextId=authentication-entra-id-upgrade-SFOS

Upgrading to SFOS 23.0 and later

When you upgrade to SFOS 23.0 or later, existing Microsoft Entra ID single sign-on (SSO) authentication continues to work without any additional configuration.

The firewall automatically makes the following changes:

  • Migrates existing Microsoft Entra ID configurations to the OpenID Connect server type and configures Microsoft Entra ID as the identity provider (IdP).
  • Removes the Directory (tenant) ID setting. The tenant ID is now specified in the Issuer URL, for example: https://sts.windows.net/<tenant ID>
  • Retrieves the OpenID Connect configuration automatically from the Issuer URL. The Microsoft Entra ID endpoint URLs are currently not supported.

Upgrading from SFOS 21.0 and earlier

When you upgrade from SFOS 21.0 and earlier to SFOS 23.0 and later, the firewall automatically turns on Microsoft Entra ID SSO for VPN services configured as Same as firewall in Authentication > Services.

To use SSO for remote access VPN, add the VPN portal and remote access URL in the application you created for the firewall in Microsoft Entra ID.