Configure Microsoft Entra ID as a Sophos Fusion IdP

Microsoft Entra ID can authenticate administrators and users for all Sophos Fusion (formerly Sophos Central) products. The migration is more than a sign-in convenience: incorrect domain, email, or MFA mapping can lock out every administrator.

This guide covers two methods. If the primary email address and User Principal Name, or UPN, are identical, Fusion’s native Entra ID configuration is sufficient. If they differ, configure Entra as an OpenID Connect provider with a dedicated App Registration and email claim.

Prerequisites and fallback

Requirements include Super Admin permissions in Sophos Fusion, approval from an Entra administrator, a verifiable custom domain, and at least two tested Fusion Super Admins. Every Fusion account’s email address must correspond to an identity in the Entra tenant.

A personal Microsoft account must not use the same organization email address. Sophos identifies this as a known conflict for federated sign-in. Remove affected addresses from the personal Microsoft account first.

Before activation, retain a Custom Sign-in Rule with Sophos sign-in for a controlled break-glass account. Test this fallback in a private browser session and do not assign it to the new IdP pilot.

When you save changed Sophos sign-in settings, Fusion automatically adds the administrator making the change to a Custom Sign-in Rule that allows Sophos sign-in. Review and retain that automatically created rule as an additional fallback; it does not replace the second Super Admin account or its separate test.

Verify the domain in Sophos Fusion

1. Open Global Settings > Access Control > Sign-in and Identity > Sophos sign-in > Verify domains.
2. Under Federated domains, select Add domain.
3. Enter the domain and description, then save.
4. Copy the displayed TXT record and publish it in the authoritative DNS.
5. After DNS propagation, open Verify domains again and select Verify domain ownership.
6. Check the value and domain, then confirm with Verify.

DNS propagation can take up to 24 hours. Successful verification is valid for one year and must be renewed before expiration. Do not remove the TXT proof before internal DNS ownership and reverification are settled.

A Fusion tenant can contain up to 1,000 domains. An individual user can nevertheless be assigned to exactly one domain and thus one matching identity provider. With multiple company or brand domains, export and review all assignments before migration.

Standard method when email address and UPN match

The Tenant ID is in the Azure portal under Microsoft Entra ID > Overview > Basic information. An Entra administrator must consent to Sophos Fusion using organizational identities; this consent applies to all Fusion products.

Then in Sophos Fusion:

1. Open Global Settings > Access Control > Sign-in and Identity > Federated identity providers.
2. Select Add identity provider and enter a name without special characters and a description.
3. Select Microsoft Entra ID for both Type and Vendor.
4. Under Configure Entra ID settings, enter the Directory or Tenant ID.
5. Under Configure domains, select the previously verified domain. Multiple domains are possible, but each user can belong to only one.
6. Select IdP enforced MFA when Entra reliably enforces MFA through Conditional Access. Otherwise, use No IdP enforced MFA so Fusion requests its own MFA after successful IdP sign-in.
7. Save, select the provider, and enable it with Turn on only after the pilot.

An incomplete or invalid provider cannot be enabled. Do not fill fields with guessed values; recheck the Tenant ID, domain, and consent.

Special case: UPN differs from the email address

Create a new single-tenant application under App registrations in the Azure portal:

1. Select New registration and assign a unique name.
2. Select Accounts in this organizational directory only.
3. Enter https://federation.sophos.com/login/callback as the Single-page application (SPA) Redirect URI.
4. Under Authentication > Implicit grant and hybrid flows, enable ID tokens.
5. Under Token configuration > Add optional claim, select token type ID and claim email.
6. Confirm Turn on the Microsoft Graph email permission.
7. Under API permissions, grant organizational approval with Grant admin consent.

Then create a provider in Sophos Fusion with type OpenID Connect and vendor Microsoft Entra ID. Use these values:

Replace <tenantId> with the Directory (tenant) ID in every value. Then select the domain and MFA owner, save, and enable the provider.

On the first Sophos page, the user still enters the email address stored in Fusion. Only on the Microsoft page do they authenticate with the differing UPN. If the ID token does not contain a matching email claim, Fusion cannot map the account despite successful Entra authentication.

Enable sign-in mode safely

Sign in at https://fusion.sophos.com. Under Global Settings > Access Control > Sign-in and Identity > Sophos sign-in, first select Sophos Fusion Admin or Federated credentials. In a private browser session, a pilot administrator tests sign-in, Entra MFA, roles, Self Service Portal, and sign-out.

Switch to Federated credentials only only after every administrator and user is assigned to a verified domain and active provider. Confirm whether Entra or Sophos enforces MFA from the actual prompt during testing, not only from the setting.

With Entra ID, the sign-in page can still show both Entra and Sophos credentials in this mode, so validate the effective path with an assigned account. While Federated credentials only is active, users cannot reset their Sophos password. If you later revert to Sophos sign-in only, users must use Reset Password to set a new Sophos password first.

Validation and troubleshooting

Successful acceptance includes two Super Admins, a normal administrator, a self-service user, and the break-glass account. Also compare the Audit Log, Conditional Access logs, and failed sign-ins.

Common failures can be narrowed down as follows:

• No redirect to Microsoft: Check sign-in mode, the user’s domain, and the enabled provider.
• Entra accepts the user but Fusion does not: Compare the Fusion email, UPN, and email claim.
• Invalid redirect URI: The SPA value must exactly match the Redirect URI specified above.
• MFA appears twice: Review ownership between IdP enforced MFA and Fusion MFA.
• A personal Microsoft account is offered: Remove the organization address from the personal account and clear browser state.
• All administrators are locked out: Use the tested Custom Sign-in Rule or second Super Admin account; without a fallback, contact Sophos Support.

Deactivate or roll back safely

Before maintaining the Entra tenant or app, change Sophos sign-in back to Sophos Fusion Admin or Federated credentials. Both Super Admins then test their Sophos access in private browser sessions. To return fully to Sophos Fusion Admin email and password, users without a usable Sophos password set a new one with Reset Password.

Only after these tests should you turn off the Fusion provider or withdraw Entra app assignments. Retain the domain, provider values, App Registration, and Custom Sign-in Rule until sign-in, roles, and the Self Service Portal have been confirmed through the fallback path. If the fallback fails, keep Entra active and restore the previous sign-in setting.

The underlying model, passkeys, and recovery are explained in Secure Sophos Fusion sign-in with MFA, passkeys, and an IdP.

Frequently asked questions