Planning Sophos ITDR: Prerequisites, licenses, regions, and roles
Before setting up ITDR, confirm the data region, license activation, Entra P1/P2 licensing, roles, and providers. Clear product and operational …
Sophos ITDR
Sophos ITDR (Identity Threat Detection and Response) reveals identity risks, misconfigurations, and signs of compromised credentials. These guides cover prerequisites and connection, security posture and directory assessment, finding investigation, and controlled configuration or decommissioning.
Table of contents
Sophos ITDR across the operational lifecycle
First clarify scope, permissions, and identity sources, then connect the relevant integration. Next prioritize organizational and identity risks, examine directory objects, and address findings or compromised credentials with authorized actions. Settings, integrations, and offboarding complete the controlled lifecycle.
Plan and connect 3
Check licensing, region, role, and product-boundary requirements. Then connect Microsoft Entra ID or on-premises Active Directory through the appropriate ITDR integration and verify the connection.
Connect Sophos ITDR to Microsoft Entra ID
This runbook covers prerequisites, the Entra ID connection, consent checks, data validation, and safe recovery from provisioning or replication …
Deploy the Sophos ITDR Sensor for on-premises Active Directory
The ITDR Sensor reads on-premises AD objects through a read-only account, synchronizes changes hourly by default, and must appear as Healthy and …
Assess security posture and the directory 3
Interpret Identity Overview and the organization-wide Risk Posture Score. Then examine identity-related Risk Scores as well as users, non-human identities, groups, devices, and applications in the ITDR Directory.
Evaluate the Sophos ITDR Identity Overview and Risk Posture Score
The Identity Overview summarizes the state of monitored identities. This guide explains every widget, the organization-wide score, and a robust daily …
Assess the Sophos ITDR Identity Risk Score safely
The Risk Score assesses active user identities individually and helps with prioritization. This article explains the scale, factors, documented scope, …
Investigate Sophos ITDR Directory and Identity Details
Practical guide to Directory tabs, filters, Human and NHI context, provider boundaries, and investigating sign-ins, Findings, and dark web records.
Investigate and respond 2
Prioritize ITDR Findings, review their details and history, and verify the effect of remediation. Address signs of compromised credentials in Dark Web Intelligence only within your own area of responsibility.
Investigate and manage Sophos ITDR Findings
This runbook covers the workflow from the prioritized Findings list through detailed review and remediation to controlled resolution, dismissal, or …
Investigate and remediate Sophos ITDR Dark Web Intelligence
From active Credential Leaks to authorised response to controlled validation: with precise views, status rules, metrics, and a severity matrix.
Configure and decommission 1
Manage integrations, monitored domains, VIP users, and Posture Checks. Prepare changes and the removal of an integration only after their effects have been documented.
Manage Sophos ITDR Identity Settings and decommission integrations safely
An operations guide to integrations, Dark Web Monitoring, Posture Check Preferences, and controlled decommissioning, with a mandatory stop before …
Keep ITDR separate from adjacent product workflows
Sophos ITDR assesses identity security posture and provides ITDR Findings, risk scores, directory information, and Dark Web intelligence. It replaces neither source-directory administration nor a general Detection and Response platform. Before taking action, therefore, establish which product generated the finding and who authorizes changes at the identity provider.
The following firm boundaries apply to adjacent tasks:
- The Sophos Central Directory Sync product synchronizes directory data for administration in Sophos Fusion (formerly Sophos Central). ITDR integrations for Entra ID and on-premises Active Directory are not configured through Directory Sync.
- XDR handles XDR Detections and cross-product investigations. ITDR can group high-risk Findings into contextual Cases and enable direct response. An individual Finding is therefore neither an XDR Detection nor equivalent to the entire Case; statuses and workflows must still be distinguished.
- MDR is a separately licensed managed service. ITDR remains primarily customer-monitored software; MDR handles only the agreed scope of active identity threats and does not automatically take over routine findings or directory administration.
- Sophos Firewall manages its own identity, network, and response functions. Firewall identities, NDR Essentials, and Active Threat Response are not ITDR integrations or ITDR Findings.
- Sophos ZTNA controls access to applications and resources. ITDR does not provide ZTNA gateways, access policies, or connections and does not replace their configuration.
In practice, this means connecting sources in a controlled manner, assessing risks and directory data in ITDR, investigating findings, making authorized corrections in the responsible system, and then verifying their effect again in ITDR. Change or remove integrations only after effects and responsibilities have been clarified.
Start standalone and use new capabilities selectively
Sophos ITDR is also available as a standalone solution without Sophos XDR or Sophos MDR. Sophos offers a free 30-day trial to get started; quotes are based on user count. Clarify region, activation, Microsoft licensing, and the binding counting rules in the ITDR prerequisites beforehand.
The product includes more than 160 recurring Posture Checks and visibility into human and non-human identities, including Microsoft AI agents, their ownership relationships, and permissions. For your own environment, start with the Directory and NHI details; check which checks are actually active and applicable under Identity Settings. The check count is not a security guarantee.
Do not equate Risk Scores with this visibility: despite broader product announcements, the current FAQ documents scores only for active user identities, not yet generally for applications and Service Principals. The score limitations govern acceptance. The Findings guide explains how contextual Cases and configured response capabilities such as password resets or session revocation supplement investigation without replacing individual findings or the required permissions.