In short: Sophos ITDR (Identity Threat Detection and Response) monitors Microsoft Entra ID and on-premises Active Directory for misconfigurations, security gaps and leaked credentials, and can force password resets, lock accounts or revoke sessions. Sophos lists it as an add-on to Sophos XDR, integrates it with MDR and offers a 30-day free trial.
What Sophos ITDR is
Sophos ITDR looks for attacks that use identities rather than malware: stolen passwords, abused admin rights, risky sign-ins and misconfigured directories. It connects to Microsoft Entra ID and on-premises Active Directory and runs automatic identity posture checks for misconfigurations and security gaps.
It also watches the dark web and breach databases for leaked or stolen credentials linked to your organisation, with enhanced monitoring for VIP accounts. It covers non-human identities too, such as service accounts and automation, and analyses the behaviour of Microsoft AI agents in your environment.
What it does with what it finds
| Function | What happens |
|---|---|
| Posture checks | Misconfigurations and security gaps in Entra ID and Active Directory are reported |
| Dark web monitoring | Leaked or stolen credentials linked to your organisation are flagged |
| VIP monitoring | Closer watch on the accounts attackers target most |
| Non-human identities | Service accounts, automation and Microsoft AI agents are included |
| Response actions | Force a password reset, lock a suspicious account or revoke active sessions |
ITDR is part of the Sophos console and integrates with Sophos XDR and Sophos MDR. With MDR, identity detections are escalated to Sophos analysts, who can lock accounts, force password resets and revoke sessions on your behalf.
How Sophos ITDR is licensed
Sophos lists ITDR as an optional add-on to Sophos XDR, and it works with Sophos MDR, where identity detections go to the Sophos operations team. Sophos does not publish the licence metric on its product page, so we confirm the count for your directory and the subscription it attaches to when we quote.
- Add-on: ITDR added to an existing or new Sophos XDR or MDR subscription.
- Billing: monthly through Forever Systems, or on a fixed term aligned to your XDR or MDR renewal.
Sophos offers a free 30-day trial, which we can set up before you commit. Ask us for a quote.
Requirements
ITDR needs a connection to your identity source: consent for the Sophos application in your Microsoft Entra ID tenant, and for on-premises Active Directory the connection described in Sophos's setup guide. We set this up and agree which response actions ITDR may take automatically and which need approval. Identity protection works best alongside strong multi-factor authentication; if you need MFA, see Cisco Duo on our specialist site.
Buying ITDR through Forever Systems
- Trial: we start a 30-day Sophos ITDR trial against your Entra ID tenant, and Active Directory if you have it.
- Review: we go through the first posture findings with you and separate quick fixes from longer projects.
- Quote: ask us for a quote for ITDR alongside your Sophos XDR or MDR subscription.
- Run: we agree which response actions may be taken, tune alerts and keep the licence in step with your organisation on one invoice with your other software.
Who it suits and how we help
ITDR suits organisations running Microsoft 365 or Active Directory that worry about account compromise, privileged access and credential leaks. It is especially useful where many staff, contractors or service accounts have more access than they need, or where nobody has reviewed directory settings for years.
We connect ITDR, review the first findings with you, prioritise fixes and keep the licence in step with your organisation. For more on the product, see Sophos ITDR, and compare tools on our identity, MFA and privileged access page.
How Forever Systems supplies your software licences
Forever Systems Ltd supplies business software subscriptions to UK organisations from one account, with one monthly invoice and a UK team who know the products.
- The right edition first time: we check what you need before you buy, so you are not paying for features you will never use
- Monthly or annual terms where the vendor offers them, and help timing renewals and commitments
- Licence changes handled for you: add or remove users, upgrade editions and true-up without starting a new contract
- Deployment and support from engineers who run these products every day, not just a reseller account
- Consolidated billing and renewal reminders so nothing lapses unexpectedly
We work with businesses, schools, charities and public sector organisations of all sizes.
Need a licence quote or a second opinion on your renewal?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is Sophos ITDR an add-on to XDR and MDR?
Sophos lists ITDR as an add-on to Sophos XDR and integrates it with Sophos MDR. We confirm the right subscription for your organisation when we quote.
Does Sophos ITDR work with on-premises Active Directory?
Yes. It supports Microsoft Entra ID and on-premises Active Directory.
Is there a free trial of Sophos ITDR?
Yes. Sophos offers a free 30-day trial. We connect it to your Entra ID tenant, and Active Directory if you have it, and review the first findings with you.
Does ITDR include dark web monitoring?
Yes. ITDR scans dark web and breach databases for leaked or stolen credentials linked to your organisation and offers enhanced monitoring of VIP accounts.