Sophos MDR: configure contacts and Threat Response

Sophos MDR requires at least one authorised contact before further MDR settings can be configured or the service used. For day-to-day operations, Avanet recommends at least two reachable contacts. Then make a deliberate decision about whether the MDR team may respond independently or needs approval first. An activated contract alone does not replace this preparation.

In Sophos Fusion (formerly Sophos Central), use the Global Settings icon to open Products & Services > MDR: first save Authorized Contacts, then approve and save Threat Response, and then complete Additional Settings. Finally, reopen all three tabs and compare them with the approved desired state. This check triggers neither an attack nor a response action.

Clarify responsibility and access before setup

You need an active MDR licence in the correct customer account and administrative access that permits editing MDR settings. After licence activation, Sophos Fusion may prompt you to complete setup at the first sign-in. The settings remain accessible later through Global Settings > Products & Services > MDR. If tabs or editing options are missing, check the account, licence and effective permissions; the role of a selectable contact does not establish a general minimum role for all settings changes.

Before changing anything, record the existing contacts, their order, telephone numbers, notification options, response mode and Collaborate checkbox state in an access-controlled change ticket. For an initial setup, document the agreed desired state instead. Contacts must know that they are expected to handle MDR enquiries and arrange an internal decision, including outside office hours.

1. Enter and save Authorized Contacts

MDR contacts are the official communication channel between the MDR team and the organisation. During an active threat, Sophos tries the configured contacts in sequence until someone responds. This is separate from Authorized Contacts under Managed Risk; contacts saved there do not replace MDR setup.

1. Open the Global Settings icon and select Products & Services > MDR > Authorized Contacts.
2. Under Primary, select the intended Sophos Fusion administrator. Eligible roles are Super Admin, Admin or Help Desk. If no suitable account exists, Create new Central administrator offers account creation. Assign administrative roles according to the actual task, rather than granting Super Admin as a precaution.
3. Enter the contact details. Check that the telephone number includes the country code; for existing numbers without one, the settings page may ask you to add it. What matters is a number at which the responsible person can actually be reached.
4. If needed, select Secondary and Tertiary and complete their details. This allows up to three contacts in total. At least Primary is mandatory; a second contact covers absences. The order should match your on-call process.
5. Deliberately review the opt-out checkboxes for MDR reports and broadcast announcements. They concern these emails and do not replace a functioning incident communication channel.
6. Select Save. Leave the tab, reopen it and read back the selection, order, telephone numbers and opt-out state.

Avanet prefers clearly assigned accounts and an established backup arrangement. Sophos also describes administrator accounts with a distribution-list address and recommends Help Desk for these because of its lower privileges. A distribution list alone, however, proves neither telephone reachability nor clear responsibility; do not grant an account elevated privileges solely for notifications.

2. Choose Threat Response deliberately

Under Global Settings > Products & Services > MDR > Threat Response, three modes are available for MDR and MDR Plus. The selection defines authority; the actual service scope also depends on the service purchased and the technical access available.

• Authorize: The MDR team may perform containment measures independently and then reports the actions taken. Under the current service scope, full neutralisation is included in MDR Plus. Tasks that Sophos cannot perform itself remain with the organisation.
• Collaborate: The MDR team investigates and coordinates the response with the contacts. Before response actions, it needs verbal or written authorisation or the organisation’s active participation. Someone within the organisation must therefore be reachable and authorised to make decisions.
• Notify Only: The MDR team notifies the contacts and can investigate only to a limited extent. It may neither contain nor neutralise threats. This mode is not an equivalent alternative to an operational response process and is not recommended for extended use.

Sophos recommends Authorize or Collaborate. Decide which fits the organisation with those responsible for incidents before saving: should Sophos be allowed to contain a confirmed threat immediately, or can the organisation reliably provide every required approval?

The checkbox under Collaborate is additional pre-authorisation

Under Collaborate, you can separately allow the MDR team to act as it would in Authorize mode if no acknowledgement is received after telephone contact attempts to all configured contacts. Without this checkbox, approval before response actions is still required. This is not a fourth mode of equal standing.

Explicitly record approval of this fallback in the change ticket. Selecting Collaborate alone does not indicate whether the fallback was approved. Nor should a fixed waiting period before intervention be assumed.

Once the decision has been made, select the desired mode and, where applicable, the checkbox, then select Save. Reopen the tab and compare both values separately with the approved state. If they differ, do not assume the change was applied successfully; clarify the account, saved selection and any concurrent changes.

3. Define Live Response boundaries and sensitive devices

With Authorize, Sophos prompts you to enable Live Response. This access allows the MDR team to work on devices. An approved response mode alone establishes neither an effective device policy nor a configured response integration.

Before approval, place sensitive computers or servers that MDR must not access through Live Response in a separate group. Under My Products > Endpoint > Policies or My Products > Server > Policies, apply a Data Collection and Investigation policy with Live Response turned off to that group. Treat computer and server policies separately. Before saving, check the group scope and previous policy assignment to avoid inadvertently opening or blocking access across the entire estate.

After the change, check the effective assignment and Live Response setting on both an intended device and an excluded device. Do not start a session for this check. Turning off Live Response is not a general exemption from MDR, other protection features or all response actions; it restricts this device access. The exception can make investigation or cleanup harder and therefore needs a responsible local contact. Isolation and Live Response explains detailed policy, role and access limits.

Prepare third-party product actions separately through MDR and XDR integrations. Data ingestion does not automatically grant write access to the source system. Likewise, the local firewall feed action Log only or Log and drop remains separate from the MDR response mode; follow the MDR Threat Feeds runbook for that task.

4. Check organisational context and agents

Under Global Settings > Products & Services > MDR > Additional Settings, enter the appropriate Industry Vertical, the organisation’s main location and the network subnets actually in use. This context helps the MDR team assess activities. Enter real inventory information approved internally, not example networks or blanket ranges unrelated to the environment. Then select Save, reopen the tab and compare the saved values.

For MDR use, each relevant computer or server needs a Sophos agent that supports MDR. Configuring contacts does not install an agent and does not, by itself, provide telemetry. If devices are missing or the agent state is unclear, continue the inventory through the Endpoint onboarding procedure. Do not accept setup as complete while intended devices and data sources remain unclear.

Acceptance without an attack or response test

Acceptance consists of saved configuration and organisational reachability, not an artificially generated Detection:

1. Reopen Authorized Contacts, Threat Response and Additional Settings. Check the saved values against the approved ticket; explicitly include the checkbox for Collaborate.
2. Internally confirm telephone numbers, country codes, reachability and the incident approval route with Primary and the backup contact. An agreed internal verification call can check the stored number but cannot prove the call path from Sophos.
3. With the mail administrators, check whether existing genuine MDR messages reach the intended recipients rather than spam or quarantine. Without such evidence, external MDR email delivery remains unverified. Neither an internal email test nor a saved contact proves it. Without verified current sender details, do not allowlist entire domains or turn off mail inspection.
4. Check the intended agent estate, effective Live Response policies and documented exceptions. Do not start a remote shell, isolation or another production action for acceptance.
5. Document responsible parties, the check date and any outstanding delivery or inventory questions. Missing evidence remains outstanding and is clarified with MDR or the mail administrators; it is not replaced with a test incident.

In subsequent operations, required customer actions are governed by the status and ownership boundaries of the individual Case. Assignee and Managed By are not interchangeable terms. The separate workflows for Classic and current MDR Cases are covered in Cases and Detection Rules.

If setup does not match the desired state

• Further MDR settings are not yet usable: First check that at least Primary has been completed in the correct customer account and saved with Save. Do not use the identically named Managed Risk page as a substitute.
• The intended person is missing from Primary: Check the administrator account and its role. Super Admin, Admin or Help Desk are the documented contact roles; contact role and editing permission for other functions remain separate.
• MDR cannot reach anyone: Check the order, country code, backup arrangement and actual on-call availability. Do not infer an automatic response from Collaborate unless the additional checkbox has been deliberately approved and saved.
• A message is missing: Check recipient assignment, quarantine and existing delivery logs. Agree a specific mail allowlist only with current, verified MDR sender details, not from a guessed address.
• Live Response is still permitted on a sensitive device: Check the Endpoint or Server policy actually assigned and the group membership. A planned exception takes effect only when the correct policy applies to the correct device.

If a contact is incorrect or a mode was changed accidentally, restore the documented previous values only after consulting the person responsible for incidents, then save and read them back again. This does not undo MDR actions already performed. During an ongoing incident, coordinate changes to response authority with the MDR team; resetting settings is not a technical rollback of an incident.