Skip to content
Avanet

Sophos ITDR

Sophos ITDR (Identity Threat Detection and Response) reveals identity risks, misconfigurations, and signs of compromised credentials. These guides cover prerequisites and connection, security posture and directory assessment, finding investigation, and controlled configuration or decommissioning.

Table of contents

Plan and connect 3 Assess security posture and the directory 3 Investigate and respond 2 Configure and decommission 1

Sophos ITDR across the operational lifecycle

First clarify scope, permissions, and identity sources, then connect the relevant integration. Next prioritize organizational and identity risks, examine directory objects, and address findings or compromised credentials with authorized actions. Settings, integrations, and offboarding complete the controlled lifecycle.

Plan and connect 3

Check licensing, region, role, and product-boundary requirements. Then connect Microsoft Entra ID or on-premises Active Directory through the appropriate ITDR integration and verify the connection.

Assess security posture and the directory 3

Interpret Identity Overview and the organization-wide Risk Posture Score. Then examine identity-related Risk Scores as well as users, non-human identities, groups, devices, and applications in the ITDR Directory.

Investigate and respond 2

Prioritize ITDR Findings, review their details and history, and verify the effect of remediation. Address signs of compromised credentials in Dark Web Intelligence only within your own area of responsibility.

Configure and decommission 1

Manage integrations, monitored domains, VIP users, and Posture Checks. Prepare changes and the removal of an integration only after their effects have been documented.

Keep ITDR separate from adjacent product workflows

Sophos ITDR assesses identity security posture and provides ITDR Findings, risk scores, directory information, and Dark Web intelligence. It replaces neither source-directory administration nor a general Detection and Response platform. Before taking action, therefore, establish which product generated the finding and who authorizes changes at the identity provider.

The following firm boundaries apply to adjacent tasks:

  • The Sophos Central Directory Sync product synchronizes directory data for administration in Sophos Fusion (formerly Sophos Central). ITDR integrations for Entra ID and on-premises Active Directory are not configured through Directory Sync.
  • XDR handles XDR Detections, Cases, and cross-product investigations. An ITDR Finding does not thereby become an XDR Detection or XDR Case; their statuses and workflows must not be treated as equivalent.
  • MDR is a separately licensed managed service. ITDR remains primarily customer-monitored software; MDR handles only the agreed scope of active identity threats and does not automatically take over routine findings or directory administration.
  • Sophos Firewall manages its own identity, network, and response functions. Firewall identities, NDR Essentials, and Active Threat Response are not ITDR integrations or ITDR Findings.
  • Sophos ZTNA controls access to applications and resources. ITDR does not provide ZTNA gateways, access policies, or connections and does not replace their configuration.

In practice, this means connecting sources in a controlled manner, assessing risks and directory data in ITDR, investigating findings, making authorized corrections in the responsible system, and then verifying their effect again in ITDR. Change or remove integrations only after effects and responsibilities have been clarified.