Synchronize Microsoft Entra ID with Sophos Central

Microsoft Entra ID synchronization imports users and groups from the organization’s tenant into Sophos Central. These objects can then be used for endpoint policies, email protection, or ZTNA policies, for example. Devices are not synchronized.

Directory synchronization is not the same as single sign-on. It makes users and groups available in Sophos Central, but it does not enable Entra sign-in to Sophos Central or configure a ZTNA identity provider. For a complete ZTNA deployment, the next step after synchronization is the Sophos ZTNA setup sequence.

⚠️ The Entra application receives extensive read access to the directory through Directory.Read.All. It should therefore be used exclusively for this synchronization. The client secret must never appear in tickets, screenshots, chats, or the repository. The application ID and tenant domain are not passwords, but they should still be anonymized in public images.

Some of the existing screenshots still show the former name Azure AD and an older portal interface. The workflow remains recognizable; the current text is authoritative for menu names and permissions.

Requirements

Before configuration, the following requirements should be met:

a suitable Sophos Central administrator role
Microsoft Entra ID and permission to register a single-tenant application
a Global Administrator or Privileged Role Administrator to grant tenant-wide admin consent
the primary tenant domain under Microsoft Entra ID > Custom domain names
email addresses for the users Sophos Central should import
an owner and a scheduled date for renewing the client secret later

Users from the same domain must not be synchronized simultaneously from local Active Directory and Microsoft Entra ID. AD can, however, continue to provide devices and device groups while Entra ID provides users and user groups from the same domain. Office 365 GCC High is not supported for this Entra ID synchronization.

Only one Entra ID source can be connected per domain. Users and email addresses must also not be synchronized to multiple Sophos Central accounts at the same time.

Connect Microsoft Entra ID to Sophos Central

1. Prepare the directory source in Sophos Central

In Sophos Central, open the Global Settings icon and go to:

Platform > Directory service > Add Microsoft Entra ID

Enter a unique name, a short description, and the primary tenant domain. After Next is selected, Central expects the Entra application details created in the following steps.

Open the directory service in Sophos Central — The Entra ID source is managed under Platform > Directory service.

Select Microsoft Entra ID as the directory service — The older interface still calls the service Azure AD sync; the current option is Add Microsoft Entra ID.

2. Register a dedicated Entra application

In the Microsoft Entra admin center, complete the following steps:

Open Enterprise applications > New application.
Select Create your own application.
Enter a unique name such as Sophos Microsoft Entra ID Sync.
Select Register an application to integrate with Microsoft Entra ID and create the application.
Select Accounts in this organizational directory only (Single tenant) as the account type.
Select Web as the redirect URI type and enter https://central.sophos.com.
Register the application.

Single tenant restricts the application to the organization’s own directory. A dedicated app also separates the Central synchronization from ZTNA, SSO, and other integrations that require different permissions or redirect URIs.

Open Enterprise applications in the former Azure portal — The older interface uses Enterprise applications; the section is now under Microsoft Entra ID.

Create a new enterprise application — New application starts the registration of the dedicated synchronization app.

Create a custom application for Entra ID synchronization — The application is registered for integration with Microsoft Entra ID.

Register a single-tenant application for Sophos Central — The Single tenant account type and redirect URI https://central.sophos.com belong to the general Central directory synchronization.

3. Record the client ID and client secret

Under Microsoft Entra ID > App registrations, open the new application. On Overview, record the Application (client) ID. The Object ID is not the client ID required here.

Then go to Certificates & secrets > Client secrets > New client secret and create a secret with an expiration date that suits the operating process. Immediately after it is created, two different values appear:

Value: Enter this value in Sophos Central as the client secret.
Secret ID: Do not use this identifier for the connection.

The secret value is visible only once. Store it immediately in an approved password manager and also document its owner and expiration date.

Open App registrations in Microsoft Entra ID — The synchronization app is configured further under App registrations.

Create a client secret for Sophos Central synchronization — Store the secret value and expiration date securely as soon as the secret is created.

4. Grant read access through Microsoft Graph

In the app registration, open API permissions > Add a permission > Microsoft Graph and add exactly this permission:

Application permissions > Directory.Read.All

Then select Grant admin consent for [Tenant]. The status must subsequently show Granted for [Tenant].

Directory.Read.All is an application permission because Sophos Central performs the synchronization in the background without a signed-in Entra user. Additional delegated permissions such as openid, profile, User.Read.All, or Group.Read.All are not required for this directory synchronization. Do not grant Directory.ReadWrite.All either: the synchronization needs read access, not write access to the tenant.

Select Microsoft Graph under API permissions — The older view shows an alternative search path; in the current interface, select Microsoft APIs > Microsoft Graph.

Select Directory Read All as an application permission — Select Directory.Read.All under Application permissions.

Grant admin consent for Directory Read All — Tenant-wide admin consent activates the permission for background synchronization.

Review the Entra app for Sophos Central synchronization — The final review includes the application ID, permission, and secret status.

5. Save and test the connection in Sophos Central

Return to the prepared directory source in Sophos Central and enter the following values:

Client ID: Application (client) ID of the Entra app
Domain: primary domain from Custom domain names, not the tenant ID
Client secret: the previously stored Value, not the secret ID
Client secret expiration: expiration date of the secret

Next, select Test connection, save the settings with Save, and repeat the connection test using the stored data. Only two successful tests confirm that Central can use the saved values.

Successful connection test between Sophos Central and Microsoft Entra ID — The connection test must succeed both before and after saving.

Select users and verify the first synchronization

Choose filters deliberately

Sophos Central can import all users and groups, up to ten groups by object ID, or objects selected through group or user filters. If Central already contains users, All users and groups is often the safest option for the first comparison because it gives Central the largest possible set of matches.

If a directory object matches an identical Central object that was previously managed manually, the synchronization can take it over as a directory object. Before the first run, document the expected matches, roles, and important policy assignments in the change record. A later purge of synchronized data cannot be undone and can remove associated data.

⚠️ Changing the filter later adjusts the synchronized inventory. Users and groups excluded by the new filter are removed from Sophos Central during the next synchronization. Manually managed objects are not affected.

If the tenant offers Preview after setup is complete, turn off the source to use it. The preview shows the selected data set, but not every consequence for existing Central objects. It remains valid for seven days or until the next synchronization; for more than 20,000 records, the result is available only as a JSON export. If the feature is unavailable, use a clearly defined pilot set and a documented list of expected objects for the first run.

Configure the schedule and start the first run

Under Synchronization schedule, select an hourly, daily, weekly, or monthly schedule. None means that every run must be started manually.

Then:

Activate Turn on.
Start Synchronize.
Under My Environment > Users & Groups, check an expected user, an expected group, and the membership relationship.
At the directory source, verify the status, last synchronization time, and the number of imported users and groups.
If warnings appear, also open Alerts and Reports > Logs > General Logs > Events.

A successful connection test proves only that Central can use the Entra app. Only the verified user and group inventory confirms that the filters and synchronization produce the intended result.

Renew the client secret before it expires

An expired secret stops subsequent synchronizations. Start the rotation before the expiration date:

Create a new client secret in the existing app registration and securely record its Value and expiration date.
Pause the Entra ID source in Sophos Central with Turn off.
Enter the new secret value and expiration date.
Run Test connection, select Save, and run Test connection again.
Activate the source with Turn on, start a synchronization, and verify the users and groups.
Remove the old secret from Entra ID only after the successful verification.

Before the source is turned on again, Revert can undo a configuration change that has not yet been activated in Central. After Turn on, the new configuration takes effect during the next run.

Troubleshoot common errors

Verification failed due to invalid client ID

The Object ID was usually copied instead of the Application (client) ID, or sign-in for the related enterprise application is disabled. Check both items in Entra ID and repeat the connection test.

AADSTS7000215: Invalid client secret

Central requires the secret Value displayed once after creation. The similar-looking secret ID does not work. If the value is no longer available, create a new secret and enter it carefully.

AADSTS7000222: Client secret expired

The secret has expired. Create a new value, store it in Central together with its new expiration date, and complete the full rotation procedure.

The connection works, but users or groups are missing

First check whether the source is turned on, a synchronization has run, and the expected schedule is active. Then verify the filters, the user’s email address, group membership, and the primary domain. Under API permissions, Directory.Read.All must appear as an Application permission with admin consent granted.

Users appear twice

Sophos Central cannot reliably merge an Entra user with a user previously created through an endpoint sign-in if the UPN, email address, and login do not match. Before cleaning up anything manually, document both identities, the affected devices, and their policy assignments.

Users disappear after a filter change

This is often not a transmission error. The new filter defines the next synchronized inventory and can remove objects imported previously. Turn the filter off or correct it, document the expected scope, and only then synchronize again.