Skip to content
Avanet

Set up Microsoft Entra ID SSO for Sophos Firewall WebAdmin

Sophos Firewall

Microsoft Entra ID SSO for WebAdmin requires four settings that fit together: an Entra group or app role, a local device access profile, the exact Web admin console URL as the redirect URI, and the Entra server under Administrator authentication methods. Only this complete chain turns a successfully authenticated Entra user into a firewall administrator with the intended permissions.

If the environment uses TACACS+ instead of OAuth for centralized device administration, follow the separate TACACS+ guide for Sophos Firewall administrators. Unlike Entra Role Mapping, TACACS+ does not automatically assign the local profile in this workflow.

⚠️ Before enabling SSO: Keep an existing local admin session open, test the local admin account from the management network, and know how to access the console or device console. SSO and Entra MFA are no reason to expose WebAdmin broadly to the WAN zone. Do not give Entra production priority until the pilot login, permissions, and local recovery path all work.

WebAdmin SSO in eight steps

  1. Check the WebAdmin FQDN, DNS, certificate, system time, and restricted access from the management network.
  2. Prepare the required administrator profiles under Profiles > Device access.
  3. In Microsoft Entra ID, create a dedicated single-tenant app with a pilot administrator, app role or security group, and a monitored client secret.
  4. Under Authentication > Servers, add a Microsoft Entra ID SSO server or extend the existing server.
  5. Set User type to Administrator and map the Entra roles or groups to the local profiles in the correct order.
  6. Add the Web admin console URL shown by the firewall to the Entra app as an exact redirect URI, then complete Test connection successfully.
  7. Enable the Entra server under Authentication > Services > Administrator authentication methods, move it up, and select Apply.
  8. In a private browser window, test a pilot admin, an unmapped user, the effective permissions, and the local fallback separately.

The feature has been available since SFOS 19.5 GA Build 197. This procedure and its limitations reflect SFOS 22.

What each layer controls

WebAdmin SSO combines several controls that are easy to confuse:

  • Device Access and Local Service ACL determine from which networks the WebAdmin console can be reached.
  • Microsoft Entra ID authenticates the user and provides role or group information in the token.
  • Role mapping on the firewall assigns the first matching token value to a local administrator profile.
  • The device access profile determines which menus the administrator cannot use, can read, or can modify.
  • Administrator authentication methods enables the Entra server for the WebAdmin login.

A normal firewall rule does not enable WebAdmin. Conversely, a reachable login page does not grant administrator rights. Device Access and Local Service ACL on Sophos Firewall explains how to restrict network access securely.

If no Role mapping matches, authentication with Entra ID can still succeed. SFOS then creates the account only as a normal user and denies WebAdmin access. This is not a browser error but a missing assignment of administrative permissions.

Entra groups or app roles

SFOS supports both options:

  • Security groups are straightforward when the organization already manages permissions through clearly named groups. The group name must match exactly in the mapping.
  • App roles apply specifically to the firewall application. The mapping uses the role’s exact Value, not just its display name.

App-specific roles provide good traceability for new administrator integrations. Security groups remain a suitable alternative when group memberships are already approved, reviewed, and documented properly. Do not mix both models without control.

SFOS evaluates mappings from top to bottom and uses the first match. Full-access and read-only assignments must therefore be mutually exclusive. If an overlap is found, correct the Entra assignments first and then retest both roles. Do not use mapping order as the permission model.

Plan the example and prerequisites

The following example uses documentation values. Replace them with values from the actual environment:

  • WebAdmin FQDN: fw01.example.com
  • Entra app: Sophos Firewall - FW01 - WebAdmin
  • Full-access app role: sfosAdminFull
  • Read-only app role: sfosAdminReadOnly
  • Local full-access profile: Administrator
  • Local read-only profile: Entra-WebAdmin-ReadOnly

example.com is a reserved example domain. The production FQDN must resolve to the correct firewall from the management network and match the WebAdmin certificate in use. For separate permission and change cycles, a dedicated Entra app with its own firewall server object for each WebAdmin integration is clearest. A shared app is possible, but it couples administrators, VPN users, and portal users to the same app assignments.

Before making the change, also make sure that:

  • A second local administrator or the local admin works independently of Entra ID.
  • The password, recovery procedure, and console access for the emergency account are documented. If this path has not yet been tested, Recover the Sophos Firewall admin password helps with safe preparation.
  • The existing administrator session remains open during the change.
  • The firewall has the correct time and can reach the required Microsoft endpoints over DNS and HTTPS.
  • The WebAdmin FQDN uses a trusted certificate with a complete chain.
  • WebAdmin can only be reached from management networks, over VPN, or from specifically allowed sources.
  • The owner and expiry date of the client secret are documented.
  • Users from the same domain are not synchronized through Active Directory and Microsoft Entra ID at the same time. Both servers may exist, but before the change it must be clear which directory manages these users on the firewall.

Configure system time and NTP and Import and assign certificates provide help with time and certificates.

Prepare device access profiles

Create the profiles before switching SSO so that every Entra value immediately maps to defined permissions. Set up Sophos Firewall administrators and profiles securely explains the general design and safe acceptance testing of local administrator profiles; this section covers only the Entra-specific mapping.

The built-in Administrator profile can be used for full access. It should be limited to the smallest necessary group of people. A custom profile is usually better for operations, auditing, or help desk staff:

  1. Open Profiles > Device access.
  2. Select Add.
  3. Enter a name such as Entra-WebAdmin-ReadOnly.
  4. Set every required menu to Read-only.
  5. Leave areas that are not required set to None.
  6. Grant Read-write only where the role genuinely requires write access.
  7. Save the profile and review it once more against the team’s actual role.

A read-only name does not make the profile read-only. The None, Read-only, and Read-write settings in the permission matrix determine the effective access. Submenus can be restricted more precisely by expanding them.

Prepare the Entra app and administrator roles

If a well-documented Entra app for VPN or Captive Portal already exists, the same Entra ID server can also be used for WebAdmin. The redirect URI, administrator roles, and tests remain service-specific. Entra ID SSO for Sophos Connect and VPN Portal explains the shared app and server foundation; local browser users follow the separate Entra ID SSO for Captive Portal procedure.

With a shared app, assign all authorized administrator, VPN, and portal groups before enabling Assignment required, then test every service in use. A dedicated WebAdmin app with its own Entra server object is clearer when administrator permissions, secret rotations, and rollouts must remain independent.

For a new integration, the current Sophos configuration includes:

  1. Under Microsoft Entra ID > App registrations, create a dedicated single-tenant application for the firewall.
  2. Add the delegated Microsoft Graph permissions User.Read.All and Group.Read.All.
  3. For group import, also add Group.Read.All as an Application Permission.
  4. Grant admin consent for the permissions.
  5. Under Certificates & secrets, create a client secret, immediately store its Value securely, and monitor the expiry date.
  6. Under App roles, create sfosAdminReadOnly and, only if required, sfosAdminFull.
  7. Under Users and groups in the associated Enterprise Application, assign the pilot administrator or a controlled pilot group to the appropriate role.
  8. For a dedicated WebAdmin app, enable Assignment required as an additional access control and assign only the intended pilot administrators or admin groups. This is an Avanet security recommendation, not a technical SFOS requirement.

Instead of app roles, dedicated security groups such as SFOS-FW01-WebAdmin-Full and SFOS-FW01-WebAdmin-ReadOnly can be used. General IT or Microsoft 365 groups are too broad for firewall administrator rights and make later reviews more difficult.

MFA for this login is enforced by the identity provider. Sophos Firewall MFA cannot be added to the same Entra SSO flow. Conditional Access should therefore be tested specifically for the firewall application, not just generally for Microsoft 365. MFA for Sophos Firewall explains how it differs from Sophos OTP.

Configure the Entra ID server on the firewall

Under Authentication > Servers, open an existing Microsoft Entra ID server or add a new one with Add > Microsoft Entra ID SSO.

Configure the server and redirect URI

  1. Enter a unique Server name.
  2. Paste the Application (client) ID from the app registration.
  3. Paste the Directory (tenant) ID.
  4. Enter the previously saved client secret Value.
  5. Choose the fallback user group deliberately. It controls user services and does not replace an administrator profile.
  6. Under Redirect URI, verify or manually set the WebAdmin FQDN.
  7. Copy the full Web admin console URL shown.

Do not construct the redirect URI yourself from the hostname, port, and an assumed callback path. In the Entra app, open App registrations > Application > Authentication > Add a platform > Web and add the exact URL displayed by SFOS.

When editing an individual firewall through Sophos Central, set the firewall hostname manually. The Central reverse SSO URL displayed automatically is not the appliance’s WebAdmin redirect URI.

Then run Test connection. The test checks network connectivity, app permissions, and TLS certificate validation. Do not change administrator authentication while it fails.

Map roles or groups to profiles

  1. Set User type to Administrator. The User setting enables only user services and is not sufficient for WebAdmin.
  2. Under Role mapping, select the Identifier type:
    • Roles for the exact app-role value, such as sfosAdminReadOnly;
    • Groups for the exact Entra group name.
  3. Under Value, enter the unchanged role value or group name.
  4. Under Profile, select the local profile, such as Entra-WebAdmin-ReadOnly.
  5. Add further mappings and review their order deliberately.
  6. Save the configuration.

Mappings are evaluated from top to bottom; the first match applies. Memberships for sfosAdminFull and sfosAdminReadOnly must therefore be mutually exclusive. If a user belongs to both, first correct the Entra assignment and retest the pilot instead of using the order as a permission rule. The list order must still be documented because it determines the effective profile if an unexpected multiple match occurs.

Enable Entra SSO for administrators

The Entra ID server becomes a WebAdmin login method only after it has been assigned to the administrator service:

  1. Open Authentication > Services.
  2. Go to Administrator authentication methods.
  3. Select the Microsoft Entra ID server.
  4. Move the server up in the list.
  5. Retain the existing local authentication as a deliberate fallback for local administrators.
  6. Select Apply.

Only one Microsoft Entra ID server can be selected per authentication method. The settings under Administrator authentication methods do not apply to the default super administrator admin. This account therefore remains a local emergency login and is not replaced by an Entra role mapping.

Test login and permissions safely

A successful Entra dialog alone does not constitute a successful test. The firewall must apply the correct profile, reject an unauthorized user, and continue to provide a local recovery path.

Positive test with pilot administrators

  1. Keep the existing local administrator session open.
  2. Open the documented WebAdmin FQDN in a private browser window.
  3. Sign in through Entra ID with the read-only pilot administrator.
  4. Complete Entra MFA and Conditional Access as planned.
  5. Verify that only the approved menus are visible and that write actions are actually unavailable.
  6. Under Authentication > Users, confirm that the account was created as an administrator with the expected profile.
  7. If full access is required, test a separate pilot administrator with the full-access role.

Do not perform the full-access test with the same account that should also receive read-only access. Two unambiguous test accounts reveal whether roles, mapping order, and local profiles are truly separated.

Negative and fallback test

  • A user who is not assigned to the Enterprise Application must not be able to complete the SSO flow successfully.
  • An assigned but unmapped user must not gain WebAdmin access.
  • A read-only administrator must not be able to save a configuration change.
  • The local admin must continue to work from the intended management network.
  • Access from a network that is not allowed must already fail at Device Access or Local Service ACL.

If the negative test gains access, the assignment, group membership, or mapping order is incorrect. Stop the pilot phase; do not work around the permission issue with a broader role or WAN exposure.

Operations, permission removal, and HA

Entra SSO moves identity and MFA to the identity provider. The administrator permissions that take effect locally must still be controlled on the firewall.

Complete role changes deliberately

When an Entra user is newly promoted to firewall administrator, SFOS applies the change at the next login. The reverse does not happen automatically: if an administrator is demoted to a normal user in Entra, the local administrator object initially remains on the firewall.

Safe procedure for a demotion:

  1. Confirm a second local administrator and the recovery path.
  2. Remove the admin role or admin group in Entra, or adjust the app assignment.
  3. Under Authentication > Users, delete the affected local administrator object in a controlled manner.
  4. Allow a new login only if the user should continue to use user services. SFOS recreates the account as a user based on the current token.
  5. Perform a negative test of a new WebAdmin login and do not assume existing sessions end automatically.

If the account should no longer use any firewall service, do not assign it again. Removing group membership alone should not be documented as immediately revoking local administrator rights that are already effective.

Monitor secrets, logs, and changes

  • Monitor the client secret expiry date with an owner and sufficient lead time.
  • Review Entra sign-in logs by application, user, MFA, and Conditional Access.
  • Use oauth_sso_webadmin.log on the firewall for the WebAdmin SSO flow.
  • Trace administrator, profile, and authentication changes through the Audit Trail.
  • Review admin groups, app roles, and device access profiles together on a regular basis.

In the Advanced Shell, the following read-only command displays the latest entries from the WebAdmin SSO service:

tail -n 200 /log/oauth_sso_webadmin.log

Sophos Firewall services and logs explains the general mapping of log files and safe read-only access.

Plan for the HA limitation

In an HA cluster, Entra ID SSO currently does not work for the WebAdmin interface of the auxiliary device. Direct peer access, recovery, and maintenance therefore require a local procedure. Mapping an Entra role to HAProfile does not remove this product limitation.

Before an HA test, document both management paths, local credentials, and roles. After a role change, retest primary access, local peer management, and SSO separately.

Troubleshooting

Entra login succeeds, but WebAdmin denies access

A matching administrator mapping is usually missing. Check User type: Administrator, the identifier type, the exact role value or group name, and the assigned profile. Under Authentication > Users, an account created as a normal user shows that no administrator mapping matched.

Administrator receives the wrong profile

Role mapping is evaluated from top to bottom. Check the account’s group memberships and app roles, remove duplicate assignments, and retest the order with a new login. Do not simply give the restrictive profile broader permissions.

Redirect ends on an error page

Compare the Web admin console URL from the firewall character for character with the redirect URI under App registrations > Authentication > Web. FQDN, port, path, DNS, and WebAdmin certificate belong to the same test. Do not use the reverse SSO URL when configuring through Central.

Test connection fails

Check access to login.microsoftonline.com and graph.microsoft.com, DNS, system time, tenant ID, client ID, client secret, Microsoft Graph permissions, and admin consent. A new redirect URI does not repair an expired secret.

If oauth_sso_webadmin.log shows x509: certificate signed by unknown authority, a root or intermediate CA for the Microsoft certificate chain actually presented may be missing. Read the chain from the firewall’s Advanced Shell to see what the firewall itself receives:

openssl s_client -connect login.microsoftonline.com:443 -showcerts

A test computer can provide a comparison, but it does not prove which chain the firewall itself sees. Import only a demonstrably missing CA from a trusted source. Do not use a server certificate as a CA or restart an SSO service as the first troubleshooting step.

SSO works on the primary but not on the auxiliary device

This is a documented HA limitation. The auxiliary WebAdmin requires tested local access. A new Entra role, broader device access, or a different redirect URI does not resolve this limitation.

Checklist

  • The local admin, a second administrator, and console access work.
  • WebAdmin can only be reached from the intended management networks or sources.
  • FQDN, DNS, certificate, and system time are correct.
  • The app registration, permissions, admin consent, and secret expiry are documented.
  • For a dedicated WebAdmin app, Assignment required is enabled and only the pilot admin group is assigned; for a shared app, all authorized admin, VPN, and portal groups are included and tested.
  • Device access profiles contain the intended permissions.
  • User type: Administrator and Role mapping are ordered correctly.
  • The exact Web admin console URL is configured as the Entra redirect URI.
  • Test connection succeeds.
  • Entra is enabled under Administrator authentication methods.
  • Read-only, full-access, negative, and local fallback tests have passed.
  • Entra sign-in logs and oauth_sso_webadmin.log have been reviewed.
  • Permission removal, secret rotation, and the HA limitation are documented operationally.