This article provides an overview for the Azure AD Federation which is another method of authentication when logging into Central.

The following Sophos Central Dashboards are supported for Azure AD Federation.

• Sophos Central Admin
• Sophos Central Enterprise
• Sophos Central Self Service Portal

Pre-Requisites required to use Azure AD Federation for your method of authentication

1. You must have an Azure Active Directory account with Microsoft. Azure AD is Microsoft’s cloud-based identity and access management service.
2. You must get consent and authorization from your Azure AD Admin to use your companies Azure AD with Sophos Central.
3. If you use Sophos Enterprise Dashboard, please take into consideration which dashboard (either Enterprise or individual Sub-Estate) you will be linking with your companies Azure AD account. You are only able to link one Central Dashboard to an Azure AD account.

Before a user is able to sign in with Microsoft, two things need to happen

1. An Azure AD administrator is required to grant consent (permission) to use credentials stored in Azure AD tenant to sign in to Central (Central Admin, Central Enterprise, Self Service Portal (SSP))
2. A Central Super Admin (Central Admin dashboard) or Enterprise Super Admin (Enterprise dashboard) needs to enable the federation setting. (Note: The enablement of the federation in the Sophos Central Admin dashboard will cover both the Central Admin and Self service portal).

• After an Azure AD (AAD) admin has granted consent and the Super Admin has enabled the federation setting, users can sign in with credentials stored in Azure AD (AAD).

• Users can use the 2nd factor of their choice (made available by their AAD Admin) – users will not be prompted for Sophos provided 2nd factor. 

 

The following sections are covered:

• Central Azure AD Federation –Workflow
• How Azure AD Admin (AAD Admin) grants consent
• Central Azure AD Federation – Enabling Federation for your account
• Central Azure AD Federation – Sign In with Microsoft

 

Applies to the following Sophos products and versions
Sophos Central Admin
Sophos Central Enterprise Dashboard
Sophos Central Email

 

Central Azure AD Federation – Workflow 

1. Grant Consent
2. Enable Federation
3. Sign in with Microsoft

 

How Azure AD Admin (AAD Admin) grants consent

An AAD admin can grant consent in the following way:

• AAD Admin can grant consent by using the URL: by either accessing from the location in both dashboards below or selecting the URL link provided below:

Sophos Central Admin

• The Central Super Admin provides consent URL to AAD Admin by selecting the consent URL: https://login.microsoftonline.com/common/adminconsent?client_id=874b428d-6926-4d97-9e5b-5ea28f49db1e&prompt=consent&scope=openid&redirect_uri=https://central.sophos.com/federation

• The Central Super Admin can also access this same URL in the Central Admin Dashboard under Global Settings  ->Administration ->  Federated sign-in

Sophos Central Enterprise Admin

• The Central Enterprise Super Admin provides consent URL to AAD Admin by selecting the consent URL: https://login.microsoftonline.com/common/adminconsent?client_id=874b428d-6926-4d97-9e5b-5ea28f49db1e&prompt=consent&scope=openid&redirect_uri=https://central.sophos.com/federation

• The Central Enterprise Super Admin can also access this same URL in the Enterprise Dashboard under Settings & Policies -> Enterprise account settings -> Federated sign-in 
  

 

1. After selecting the consent URL you will be redirected to the Microsoft login page, sign in using your microsoft username, select Next.
   

2. Enter your password, select Sign in.

3. The Permissions requested will be presented, select Accept.

4. Confirmation will be presented granting Consent approval.

 

Central Azure AD Federation – Enabling Federation for your account 

Sophos Central Admin Dashboard

Once the consent has been granted, a Super Admin for Sophos Central Admin will need to enable the federation setting. (Note: The enablement of the federation in the Sophos Central Admin dashboard will cover both the Central Admin and Self service portal).

1. Enable federation by selecting the  “Federated sign-in” setting, which is available under Global Settings ->
   Administration -> Federated sign-in

2. Turn on federation by selecting the  “Sign in with Sophos Central Admin or Microsoft credentials” setting.

3. Select Save to Save the setting.

 

Sophos Central Enterprise Dashboard

Once the consent has been granted, a Enterprise Super Admin for Sophos Central Enterprise will need to enable the federation setting.

1.  Enable federation by selecting the “Federated sign-in” setting, which is available under Settings & Policies-> Enterprise account settings -> Federated sign-in

2. Turn on federation by selecting the “Sign in with Sophos Central Admin or Microsoft credentials” setting.

3. Select Save to Save the setting.

 

Central Azure AD Federation – Sign In with Microsoft

Sophos Central Admin Dashboard/Self Service Portal

1. At the login screen , click on Sign In with Microsoft.

Sophos Central Admin                                                                                                   Self Service Portal

2. Enter your username credentials and select "Next".

3. Enter your password and select "Sign in"

4. The Sophos Central Login screen will take a moment to sign you in.

5. You will be logged in successfully to either your Sophos Central Admin or Self Service Portal using your Microsoft credentials.

Sophos Central Enterprise Dashboard

"The same steps 1-4 indicated above can be followed to sign in with Microsoft to the Enterprise Dashboard."

1. This will result in being logged in successfully to your Sophos Central Enterprise dashboard using your Microsoft credentials.

 

NOTE: Sign in With Microsoft: Unable to sign in.

• If the AAD Admin does not have a Sophos Account, they will not be able to log into Central after consent has been granted.

• If the AAD Admin has a Sophos Account, but federation is not enabled, the AAD Admin will not be able to log in to Central after consent has been granted.

Note: this will also result in an Audit log entry with the description of "Unsuccessful federated authentication - federation not enabled" for the user who was attempting to log in via the 'sign in with Microsoft' option

 

 

Feedback and contact

If you've spotted an error or would like to provide feedback on this article, please use the section below to rate and comment on the article.
This is invaluable to us to ensure that we continually strive to give our customers the best information possible.