Configure Microsoft Entra ID as a Sophos Central IdP

Microsoft Entra ID can authenticate administrators and users for all Sophos Central products. The migration is more than a sign-in convenience: incorrect domain, email, or MFA mapping can lock out every administrator.

This guide covers two methods. If the primary email address and User Principal Name, or UPN, are identical, Central’s native Entra ID configuration is sufficient. If they differ, configure Entra as an OpenID Connect provider with a dedicated App Registration and email claim.

Prerequisites and fallback

Requirements include Super Admin permissions in Sophos Central, approval from an Entra administrator, a verifiable custom domain, and at least two tested Central Super Admins. Every Central account’s email address must correspond to an identity in the Entra tenant.

A personal Microsoft account must not use the same organization email address. Sophos identifies this as a known conflict for federated sign-in. Remove affected addresses from the personal Microsoft account first.

Before activation, retain a Custom Sign-in Rule with Sophos sign-in for a controlled break-glass account. Test this fallback in a private browser session and do not assign it to the new IdP pilot.

Verify the domain in Sophos Central

1. Open Global Settings > Access Control > Sign-in and Identity > Sophos sign-in > Verify domains.
2. Under Federated domains, select Add domain.
3. Enter the domain and description, then save.
4. Copy the displayed TXT record and publish it in the authoritative DNS.
5. After DNS propagation, open Verify domains again and select Verify domain ownership.
6. Check the value and domain, then confirm with Verify.

DNS propagation can take up to 24 hours. Successful verification is valid for one year and must be renewed before expiration. Do not remove the TXT proof before internal DNS ownership and reverification are settled.

A Central tenant can contain up to 1,000 domains. An individual user can nevertheless be assigned to exactly one domain and thus one matching identity provider. With multiple company or brand domains, export and review all assignments before migration.

Standard method when email address and UPN match

The Tenant ID is in the Azure portal under Microsoft Entra ID > Overview > Basic information. An Entra administrator must consent to Sophos Central using organizational identities; this consent applies to all Central products.

Then in Sophos Central:

1. Open Global Settings > Access Control > Sign-in and Identity > Federated identity providers.
2. Select Add identity provider and enter a name without special characters and a description.
3. Select Microsoft Entra ID for both Type and Vendor.
4. Under Configure Entra ID settings, enter the Directory or Tenant ID.
5. Under Configure domains, select the previously verified domain. Multiple domains are possible, but each user can belong to only one.
6. Select IdP enforced MFA when Entra reliably enforces MFA through Conditional Access. Otherwise, use No IdP enforced MFA so Central requests its own MFA after successful IdP sign-in.
7. Save, select the provider, and enable it with Turn on only after the pilot.

An incomplete or invalid provider cannot be enabled. Do not fill fields with guessed values; recheck the Tenant ID, domain, and consent.

Special case: UPN differs from the email address

Create a new single-tenant application under App registrations in the Azure portal:

1. Select New registration and assign a unique name.
2. Select Accounts in this organizational directory only.
3. Enter https://federation.sophos.com/login/callback as the Single-page application (SPA) Redirect URI.
4. Under Authentication > Implicit grant and hybrid flows, enable ID tokens.
5. Under Token configuration > Add optional claim, select token type ID and claim email.
6. Confirm Turn on the Microsoft Graph email permission.
7. Under API permissions, grant organizational approval with Grant admin consent.

Then create a provider in Sophos Central with type OpenID Connect and vendor Microsoft Entra ID. Use these values:

Replace <tenantId> with the Directory (tenant) ID in every value. Then select the domain and MFA owner, save, and enable the provider.

On the first Sophos page, the user still enters the email address stored in Central. Only on the Microsoft page do they authenticate with the differing UPN. If the ID token does not contain a matching email claim, Central cannot map the account despite successful Entra authentication.

Enable sign-in mode safely

Under Global Settings > Access Control > Sign-in and Identity > Sophos sign-in, first select Sophos Central Admin or Federated credentials. In a private browser session, a pilot administrator tests sign-in, Entra MFA, roles, Self Service Portal, and sign-out.

Switch to Federated credentials only only after every administrator and user is assigned to a verified domain and active provider. Confirm whether Entra or Sophos enforces MFA from the actual prompt during testing, not only from the setting.

Validation and troubleshooting

Successful acceptance includes two Super Admins, a normal administrator, a self-service user, and the break-glass account. Also compare the Audit Log, Conditional Access logs, and failed sign-ins.

Common failures can be narrowed down as follows:

• No redirect to Microsoft: Check sign-in mode, the user’s domain, and the enabled provider.
• Entra accepts the user but Central does not: Compare the Central email, UPN, and email claim.
• Invalid redirect URI: The App Registration must contain exactly https://federation.sophos.com/login/callback as an SPA.
• MFA appears twice: Review ownership between IdP enforced MFA and Central MFA.
• A personal Microsoft account is offered: Remove the organization address from the personal account and clear browser state.
• All administrators are locked out: Use the tested Custom Sign-in Rule or second Super Admin account; without a fallback, contact Sophos Support.

The underlying model, passkeys, and recovery are explained in Secure Sophos Central sign-in with MFA, passkeys, and an IdP.

Frequently asked questions