Skip to content

IDR Integration Guide🔗

When Taegis™ IDR has been enabled for your tenant, select Identity from the Taegis Menu to begin configuring your integration with Microsoft Entra ID or on-premises Active Directory (AD).

Microsoft Entra ID🔗

The setup process uses the Sophos Master Application in Azure to automatically create the required application and grant the necessary permissions within your Azure tenant.

Prerequisites🔗

  • Access to XDR with the Identity module enabled
  • XDR Tenant Administrator role
  • Entra ID Admin role with permissions to Grant Tenant Wide Admin Consent
  • Microsoft Entra ID P1 or P2 license. Optional Microsoft licenses let IDR collect more data. See Microsoft License Requirements.

Set up the Microsoft Entra ID Integration🔗

  1. From the Taegis Menu, go to Identity.

  2. The Identity Settings page shows two integration cards:

    • Microsoft Entra ID for cloud-based identity monitoring
    • On-Premise Active Directory for on-premises AD environments

  3. Click Set Up on the Microsoft Entra ID card.

    Click Set Up

  4. Enter a name for the integration and click Next.

    Name the Integration

  5. Click Authorize to be redirected to Microsoft's identity provider.

    Click Authorize

  6. When prompted, sign in with a user account that lets you grant organization-wide consent for integration with the Entra ID tenant. Then approve the listed permissions to give IDR access to Entra ID. For more information, see the Microsoft documentation.

  7. When setup is complete, click Close.

Retry Integration Authorization🔗

If the Admin Consent process fails with an error that states the applications weren’t found, Microsoft replication delays usually cause the issue. Use the following steps to complete the setup:

  1. Wait 15–30 minutes for the service principals to replicate across Microsoft’s infrastructure. You can continue working on other tasks while you wait.

  2. Go to Identity > Settings.

  3. Click the Ellipsis icon in the Actions column and select Grant Admin Consent, which redirects you to Microsoft’s identity provider to complete authorization.

    Click Grant Admin Consent

  4. When prompted, sign in with an account that can grant organization-wide consent for the Entra ID tenant. Approve the listed permissions to grant IDR access to Entra ID. For more information, see the Microsoft documentation.

  5. After you grant consent, click the Refresh icon to re-provision the integrations.

    Reprovision Integration

Tip

Provisioning retries automatically for up to 60 minutes. Click Refresh only if more than 60 minutes have passed since you started the integration.

On-Premises Active Directory🔗

The on-premises Active Directory integration allows you to deploy the Sophos ITDR sensor to extend identity security monitoring to your on-premises AD environment. The ITDR sensor currently supports English language only.

Note

The on-premises AD integration can be deployed independently without a Microsoft Entra ID integration. When used without Entra ID, visibility and posture assessments are limited to your on-premises AD environment only.

Prerequisites🔗

  • Access to XDR with the Identity module enabled.
  • XDR Tenant Administrator role.
  • An Active Directory server running a supported Windows Server version (2016–2025) with Microsoft .NET Framework 4.8 installed.
  • Knowledge of your AD domain names, such as CORP.LOCAL or CHILD.CORP.LOCAL.
  • A read-only service account in AD.
  • If your organization has removed Authenticated Users from the built-in Pre-Windows 2000 Compatible Access group, the service account must be a member of that group. See the following note for more information.

Important

This prerequisite applies only if your organization has hardened the built-in Pre-Windows 2000 Compatible Access group by removing Authenticated Users from it.

In that case, make sure the IDR sensor service account is a member of the group. Otherwise, the sensor can still connect and list users, but it receives empty or 0 values for attributes such as userAccountControl, pwdLastSet, lastLogon, and lastLogonTimestamp, and identity details and posture findings for those accounts are incomplete.

To add the service account to the group, do as follows:

  1. On a domain controller, open Active Directory Users and Computers.
  2. Go to the Builtin container and open Pre-Windows 2000 Compatible Access.
  3. In the Members tab, click Add, and add the service account.

Members of this group have read access to all users and groups in the domain, so add only the service account. For details, see Active Directory Security Groups.

Always consult your organization's security policies and practices before changing group membership, and verify the change for possible breaking effects in your environment.

  • Outbound firewall access enabled to these domains if your firewall blocks by default.

Set up the On-Premises Active Directory Integration🔗

To set up the on-premises AD integration:

  1. From the Taegis Menu, go to Identity.

  2. The Identity Settings page shows two integration cards:

    • Microsoft Entra ID for cloud-based identity monitoring
    • On-Premise Active Directory for on-premises AD environments

  3. Click Set Up on the On-Premise Active Directory card.

    On-Premise Active Directory Setup Card

    Tip

    The card also provides links to download the ITDR Sensor and to open the documentation if needed before setup.

  4. In On-Premise Active Directory, fill in the following fields and then click Next.

    Field Description Example
    Name the directory service A friendly display name for this integration Production AD
    Active Directory domains to monitor Comma-separated list of AD domain names to monitor CORP.LOCAL, CHILD.CORP.LOCAL

    On-Premise Active Directory Setup Dialog

    Important

    When you click Next, a Client ID and Client Secret are automatically generated. This process may take a few minutes.

  5. After credentials are generated, the API Credential Summary shows the following:

    • Name: The display name you entered.
    • Domains: The AD domains you specified.
    • Client ID: Auto-generated identifier for the ITDR sensor.
    • Client Secret: Auto-generated secret for the ITDR sensor.

    API Credential Summary

    Important

    The Client Secret is only shown once. You must copy or download the secret before closing this dialog. It cannot be retrieved again. Credentials expire in 36 months.

  6. Click Download client secret to save the credentials as a file, or click the Copy icon next to each field to copy the Client ID and Client Secret to your clipboard.

Download and Install the ITDR Sensor🔗

To download and install the sensor:

  1. Click Download ITDR Sensor to download the sensor installer.
  2. Transfer the installer to the Windows Server that will host the sensor on your on-premises network.

  3. Run the installer on that server and work through the setup wizard:

    ITDR Sensor Setup Wizard

  4. When prompted, enter the Client ID and Client Secret generated in the preceding section, then click Next.

    Sophos Credentials Entry

  5. Configure LDAP settings, then click Next. We recommend selecting LDAP over SSL for secure communication.

    LDAP Configuration

  6. Enter the Service Account username and password, then click Next.

  7. Select the Domains you want to include in monitoring, then click Next.

    Domain Selection

  8. On the AD Filters tab, leave the default settings selected to ensure all required object types are collected, then click Next.

    AD Filters

  9. On the Sync Schedule tab, leave the default interval set to 1 hour to ensure timely updates, then click Finish.

    Sync Schedule

  10. After the wizard completes, a communication status window appears. Click Sync Now to run the initial full sync of your AD environment.

Note

The first sync may take several minutes depending on the size of your AD environment. Subsequent syncs send only incremental changes.

Verify the Integration🔗

When the ITDR sensor is installed and running, do as follows to verify the integration:

  1. Return to Identity Settings in XDR.

  2. Your new integration shows in the Configured Integrations table with the following details:

    • Type: On-Prem Active Directory
    • Health: Healthy
    • Status: Enabled (toggle on)

  3. If the Health status shows as Unhealthy, verify the following:

    • The ITDR sensor service is running on the host server.
    • The Client ID and Client Secret were entered correctly.
    • The server has outbound network connectivity to Sophos cloud services.

    For the specific reason and recommended action, see Integration Health.

Sophos ITDR Active Directory Domains🔗

If you're using the ITDR sensor and your firewall blocks outbound access by default, you need to allow the following domains to enable outbound communication from the ITDR sensor to the Sophos cloud. The list covers agent data upload, sensor updates, and agent authentication and API access.

Ports

  • 443 (HTTPS)
  • 53 (DNS)

Domains

# Agent Data 
tf-presigned-url-eu-west-1-prod-itdr-bucket.s3.eu-west-1.amazonaws.com
tf-presigned-url-eu-central-1-prod-itdr-bucket.s3.eu-central-1.amazonaws.com
tf-presigned-url-us-east-2-prod-itdr-bucket.s3.us-east-2.amazonaws.com
tf-presigned-url-us-west-2-prod-itdr-bucket.s3.us-west-2.amazonaws.com
tf-presigned-url-ca-central-1-prod-itdr-bucket.s3.ca-central-1.amazonaws.com
tf-presigned-url-ap-southeast-2-prod-itdr-bucket.s3.ap-southeast-2.amazonaws.com
tf-presigned-url-ap-northeast-1-prod-itdr-bucket.s3.ap-northeast-1.amazonaws.com
tf-presigned-url-ap-south-1-prod-itdr-bucket.s3.ap-south-1.amazonaws.com
tf-presigned-url-sa-east-1-prod-itdr-bucket.s3.sa-east-1.amazonaws.com
tf-presigned-url-me-central-1-prod-itdr-bucket.s3.me-central-1.amazonaws.com
# Agent updates
downloads.sophos.com
# Agent Authentication and API access
id.sophos.com
cloud.sophos.com
api.central.sophos.com
api-global.central.sophos.com
api-eu01.central.sophos.com
api-eu02.central.sophos.com
api-us01.central.sophos.com
api-us02.central.sophos.com
api-us03.central.sophos.com
api-ca01.central.sophos.com
api-au01.central.sophos.com
api-jp01.central.sophos.com
api-in01.central.sophos.com
api-br01.central.sophos.com
api-ae01.central.sophos.com

Set Up Automations🔗

If you want to use response actions with IDR, you can configure the necessary actions, playbooks, and connectors, including on-premises LDAP automations and automated response actions for Identity findings.

For more information, including important hybrid Microsoft Entra ID behavior to be aware of, see Identity Response Actions.