Skip to content
Avanet

Planning Sophos ITDR: Prerequisites, licenses, regions, and roles

Sophos ITDR

Before you set up Sophos ITDR, establish which region, licenses, and roles apply. You also need to decide whether the data will come from Microsoft Entra ID, on-premises Active Directory, or both, and assign day-to-day ownership of ITDR Findings. Use this quick check to cover all six decisions.

Pre-setup quick check:

  1. Check the existing tenant’s data region under Account Details > Account Preferences. The current ITDR region matrix lists US, EU, CAN, AUS, JPN, IND and BRA as available; UAE is not approved. The region check below explains the mapping and limitations.
  2. ITDR is available independently without Sophos XDR or Sophos MDR. Confirm that ITDR has been activated in the correct tenant; My Products > Identity should then be visible. Quotes are based on user count, but this establishes neither a definitive public SKU name nor the exact counting rules; check these details against the License Schedule and with the Sophos Partner.
  3. Confirm a Microsoft Entra ID P1 or P2 license for every Entra integration. Entra ID Free is not an adequate basis for planning.
  4. Designate a Sophos administrator to perform the setup and an Entra administrator who can grant tenant-wide admin consent. These are separate roles.
  5. Decide whether to connect Microsoft Entra ID, on-premises Active Directory, or both. The ITDR integration does not replace Central Directory Sync.
  6. Assign someone to review and manage ITDR Findings on an ongoing basis. An MDR license does not transfer this routine task to Sophos MDR.

Once the license is active, ITDR appears under My Products > Identity, with configuration available under My Products > Identity > Settings. If Identity is missing, do not proceed straight to creating an integration. Check the data region, tenant, license status, and role first.

1. Check the data region before purchasing a license or choosing a tenant

The ITDR region matrix dated October 14, 2026 lists the following region groups as available:

  • US and EU
  • CAN – Canada
  • AUS – Australia
  • JPN – Japan
  • IND – India
  • BRA – Brazil

UAE is marked as unavailable for ITDR in this matrix. Additional availability for Canada, Australia, Japan, India, and Brazil was released on August 10, 2026. An existing tenant in one of these regions is therefore not ineligible merely because of its region. The matrix uses EU as a region group; no additional EU subregions or more detailed data residency guarantees are inferred from it. If the region displayed in the account cannot be mapped clearly, clarify it with Sophos for this tenant before setup.

The existing tenant’s actual region is decisive, not the company’s location or billing address. A license does not override a regional product restriction. If Identity is missing in a now-supported region, first check the correct tenant, ITDR license activation, and role. License cancellation or a new tenant is not a blanket solution. Regional restrictions for other products must not be treated as ITDR exclusions.

Regional approval is not an in-place migration. According to the region notice, the tenant data region selected cannot be changed after submission; automatic transfer of configurations and data to another tenant is not guaranteed either. For a genuinely unsupported or unclear region, agree on the specific approach with the Sophos Partner or Support before purchasing or creating a new tenant. Obtain separate approval for data protection, data residency, existing products, integrations, and migration effort before creating a new tenant.

2. Check Sophos and Microsoft licenses separately

An Entra connection has two independent licensing requirements.

Sophos ITDR in the correct tenant

The ITDR product documentation requires an activated ITDR license. Only then should My Products > Identity or My Products > Identity > Settings become available.

Since the product announcement on October 15, 2026, ITDR has been available as a standalone solution; Sophos XDR or Sophos MDR are not purchase prerequisites. Native integration with both remains, but must not be equated with included XDR or MDR capabilities or services. Sophos offers a free 30-day trial for evaluation. The technical prerequisites for region, provider, and permissions also apply during the trial; neither automatic conversion to a paid license nor a particular end-of-trial procedure is assumed here.

Sophos bases ITDR quotes on user count. However, the announcement defines neither an unambiguous ordering SKU nor the exact counting method, for example for guests, disabled accounts, service accounts, or NHI. Therefore, do not derive an order quantity from the Directory total or the number of visible Risk Scores. Inclusion in other packages is not guaranteed across the board either. Before activation, obtain written confirmation of at least the following:

  • name and data region of the Fusion tenant;
  • product description and term on the License Schedule;
  • agreed scope, quoted user count with a confirmed counting method, and start date;
  • responsible Sophos Partner;
  • intended Entra and AD environments.

General activation and verification in Sophos Fusion (formerly Sophos Central) are covered in “Activate, check, and renew Sophos Fusion licenses”. For ITDR, the practical check remains the same: Identity is visible in the correct tenant, and the intended administrator account can open Settings.

Microsoft Entra ID P1 or P2

Sophos requires Entra ID P1 or P2 for the Microsoft Entra ID integration. The entitlement may be a standalone product, an add-on, or part of another Microsoft plan. Sophos gives Microsoft 365 E3 and E5, Microsoft Business Premium, and Microsoft 365 Frontline Worker F1, F3, and F5 as examples. What matters, however, is the effective P1/P2 entitlement in the tenant being connected, not merely the display name of a purchased package.

Entra ID Free is not sufficient. Although the Free edition provides Microsoft APIs, it limits the available data and Posture Checks that can be run. An integration may therefore show Provisioning Failed. A technically reachable API endpoint is not proof of licensing.

After an upgrade from Free to P1 or P2, Sophos states that Microsoft-provided information such as admin or MFA status may be delayed by up to one week. Account for this delay in the schedule. After an upgrade, check the Authentication Methods Activity Report in the Microsoft Entra admin center, and bear in mind that ITDR cannot show the current status until Microsoft has updated the data.

Two administrative domains are involved in the setup:

  • Sophos Fusion: The ITDR integration instructions explicitly list a Sophos Fusion Administrator role as a prerequisite.
  • Microsoft Entra ID: The Entra account used must be able to grant tenant-wide admin consent.

The phrase Sophos Fusion Administrator role is too imprecise to identify either a distinct predefined role or a minimum Custom Role. The published Fusion role tables list Super Admin, Admin, Help Desk, Read-only, and User, but identify neither an ITDR-specific permission nor a role with that exact name. Consequently, no specific minimum ITDR role can be established: the documentation proves neither that Super Admin is always required nor that a self-defined Custom Role will suffice.

For a controlled rollout:

  1. Select an existing Super Admin or Admin as the setup account without granting permanent Super Admin rights unnecessarily.
  2. Before the maintenance window, use this account to confirm that My Products > Identity > Settings > Integrations and the intended setup action are available.
  3. Have the separate Entra administration team designate an account that can perform Grant Tenant Wide Admin Consent.
  4. Record the Sophos and Microsoft accounts, responsible person, time, and purpose of consent in the change log.
  5. After setup, test with the intended least-privileged Fusion role: authorized pages must be visible, while changes outside its permissions must remain blocked.

A visible page does not prove that a change is permitted. Conversely, license-dependent permissions may be entirely absent without the appropriate license. For details about predefined and custom roles, see “Assign Sophos Fusion administration roles correctly”. Neither that article nor this one claims that a specific “ITDR Custom Role” exists unless Sophos publishes a verifiable ITDR permission matrix.

4. Choose identity providers and the scope of monitored identities

ITDR supports these identity providers:

  • Microsoft Entra ID for cloud-based identity data;
  • on-premises Active Directory through the separate ITDR sensor.

You can add multiple Microsoft Entra ID tenants through Identity Settings. This does not mean that a one-time check of licensing, consent, or ownership automatically applies to every tenant. For each connection, document the tenant ID or unique tenant name, P1/P2 entitlement, consent account, person responsible for operations, and expected scope.

The monitored identity population includes active human and non-human identities:

  • Human identities: for example, employees, guests, and external users.
  • Non-Human Identities (NHI): for example, applications, Service Principals, Service Accounts, machines, and other identities that authenticate or authorize access or perform transactions between systems.

Visibility also includes Microsoft AI agents, their access rights, and ownership relationships. Runtime identity, Blueprint Principal, and an optional paired user account are examined separately in the Directory and NHI details.

Visibility is not score coverage: the current product FAQ continues to limit Risk Scores to active user identities; Service Principals and applications, as well as deleted or disabled users, do not receive a score. The broader announcement of scoring every human and non-human identity therefore cannot be relied upon as a general availability commitment. Use the documented user scope for planning and acceptance; have any required NHI score confirmed for the specific tenant beforehand. The Identity Risk Score limitations explain this distinction.

5. Define responsibilities between the customer and MDR

ITDR is software that the customer monitors; it is not a managed service. The customer’s operating process must name a primary owner and deputy, set triage time frames, and define both ownership and the remediation procedure.

If Sophos MDR is licensed separately, the MDR Operations Team also investigates identity threats. Clear boundaries apply:

  • MDR focuses primarily on active identity threats.
  • MDR reviews only a subset of critical or high-severity Findings that may indicate an active threat.
  • The customer remains responsible for ongoing monitoring and management of ITDR Findings.
  • Additional Entra ID context can help MDR assess correlated users and risks more quickly in identity and non-identity investigations.

An MDR license therefore does not provide comprehensive triage of all ITDR Findings or automatic remediation of every identity risk. Before go-live, define who handles routine Findings, when an active incident is escalated to MDR, and who approves changes in Entra ID or AD.

6. Keep product boundaries separate

ITDR complements other Sophos capabilities; it does not replace them. Keeping that boundary clear prevents a successful ITDR rollout from being treated as acceptance of other products.

Central Directory Sync

The Entra and AD sensor integrations provide ITDR with identity and directory data for Posture, Directory, and Findings. Dark web monitoring is configured separately for domains that are imported automatically from Entra or added and verified manually. Neither these ITDR integrations nor dark web monitoring replace Central Directory Sync. A configured ITDR environment therefore does not confirm that Central users or groups are synchronized for other products, nor does it replace mapping, filtering, or deletion rules. The prerequisites for the separate directory synchronization process are covered in “Sophos Central Directory Sync: Prerequisites and architecture”.

XDR and MDR

ITDR Findings are not XDR Detections. Sophos now describes automatic grouping of high-risk Findings into contextual Cases and direct response capabilities from ITDR. This neither automatically turns an individual Finding into an XDR Detection nor equates Finding and Case statuses; the explanation of Cases and response separates these layers. XDR license entitlements and XDR roles must still not be interpreted as an ITDR license or ITDR permission. MDR is a separately licensed service with the limited investigation scope described above; it does not take over routine daily Findings.

Firewall, NDR, and Active Threat Response

Sophos Firewall identity features, NDR or NDR Essentials, and Active Threat Response remain separate products or workflows. An Identity visible in ITDR does not configure a firewall rule, validate an NDR sensor, or automatically trigger a firewall or ATR action. These integrations require their own licensing, role, data, and acceptance checks.

ZTNA

Sophos ZTNA controls access to applications using its own gateway, connector, policy, and Identity configuration. ITDR assesses identity risks and misconfigurations; it does not automatically provide a ZTNA access path or replace a ZTNA policy. A shared Identity source does not make the two product workflows identical.

7. Acceptance before technical onboarding

Do not begin Entra authorization or sensor deployment until the following points are documented:

  • The specific Fusion tenant and its region have been identified.
  • The tenant region maps to an approved ITDR region group US, EU, CAN, AUS, JPN, IND or BRA; UAE is not approved, and any unclear mapping was resolved before setup.
  • The ITDR license is activated in the correct tenant, and My Products > Identity is visible.
  • The License Schedule, term, and partner contact have been recorded; the user count used for the quote and its counting method are confirmed. No unsupported SKU or quantity key has been assumed.
  • P1 or P2 entitlement has been confirmed for each Entra tenant.
  • The tenant or domain, responsible person, and intended scope have been documented for each provider.
  • The Fusion setup account can open Identity > Settings > Integrations and perform the required action.
  • A separate Entra account can grant tenant-wide admin consent.
  • Human identities and NHI have been included to the expected extent.
  • Customer responsibility for Findings and possible escalation to MDR have been defined.
  • Directory Sync, XDR, MDR, Firewall/NDR/ATR, and ZTNA have been treated as separate workflows.

Success criterion: Preparation is complete only when the menu item is visible and there is evidence for the region, both licensing levels, both administrative domains, each provider’s scope, and the person responsible for operations. Validate the integration itself and its data quality separately afterward.

Documentation limitations

This article is based on product, role, and FAQ content reviewed as of September 20, 2026; regional availability was updated on October 16, 2026, using the region matrix of October 14, 2026 and release notes of August 10, 2026. Standalone availability, the trial, the basis for quotes, and the explanation of Cases were added on October 20, 2026, using the new announcements; score coverage was checked against the current product FAQ. The article does not describe independent product or lab testing. In particular, the available evidence does not cover:

  • a definitive public ITDR SKU or a general license counting model;
  • an exact minimum ITDR Custom Role or individual ITDR permission names;
  • an in-place migration between Fusion data regions;
  • an ITDR-specific retention or end-of-life commitment;
  • any automatic effect of ITDR on Central Directory Sync, XDR, Firewall, NDR, Active Threat Response, or ZTNA.

If any of these points is required for a procurement, data protection, or authorization decision, confirm it for the specific tenant with the Sophos Partner or Sophos Support before setup rather than inferring it from documentation for adjacent products.