Hi, I am Jose from Sophos Support.
Today we will be talking about Azure AD Sync for Sophos Email.
Azure AD Sync is a web application that synchronizes Azure Active Directory objects
to Sophos Central and is utilized by various products in the Sophos Central environment.
In this video, we will discuss how the feature is implemented.
Here is a quick overview of how Azure AD Sync functions.
Azure AD Sync contacts the Azure application and provides the client secret to authenticate.
The Azure application has now permission to read Azure ID and provides users and groups information to Azure AD Sync.
Here are the requirements. You must have an Azure subscription in the working Azure AD.
Support can help integrate, however can only troubleshoot within the scope of our product.
An Azure application and information that Central needs to communicate with
Azure AD must be present.
A directory read all permission for that application must be present.
Make sure any existing users or groups in Sophos Central have an Azure AD match.
If any users or groups don't match, you need to manage them manually in Sophos Central.
Lastly, make sure all the Azure Ad users that needs to be synchronized have an email address.
This is essential for mailbox creation within Sophos Email.
Otherwise any email that does not have a mailbox or alias will be rejected.
There are also some restrictions.
You cannot synchronize multiple Azure AD sources from the same domain.
You cannot synchronize users or email addresses to multiple Sophos Central admin accounts.
Users and email addresses must be unique in each Sophos Central admin account.
You cannot synchronize users from the same domain using Active Directory and Azure AD.
Only one can be used at a time.
Installation is composed of two parts. First is configuration within Azure.
We will go to Azure AD then creates an Azure application.
This is the application that Central contacts to get the user and group information it needs to populate itself.
Click on "Enterprise applications".
"New applications".
"Create your own application"
in the pop-up. Supply a logical name for your application.
I named mine Sophos Azure AD Sync.
Select "Register an application to integrate with Azure AD" and click on "Create".
This will take you to the register and application screen.
Under "Who can use this application or accept this API?" select "Accounts in this organizational directory only".
Under the "Redirect URI" make sure that the "Web" option is selected.
Put central.sophos.com in the space provided, then click on 'Register".
To confirm, go to "All applications" and you should see it listed.
Next is to set up the client secret.
Go to "App registrations".
Under the "Owned applications" tab, click on the application you created previously.
Click on "Certificates & Secrets" "New client secret".
In the pop-up screen, supply a logical description and choose the expiry as 12
months or how long you want the secret to last.
Click on "ADD" and you should see it listed under the "Client secrets" tab.
Make sure you copy the value and expiry date somewhere as these are part
of what we need to enter in central later.
Now we will set the application permissions to inform Azure what the
application is permitted to do within the Azure AD environment.
Go to "App registrations". Under the "Owned applications" tab.
Click on the application you created previously.
Click on "API permissions" then "Add permission".
In the pop-up screen, under the “APIs my organization uses”
make sure you choose “Microsoft Graph”.
Click on “Application permissions” and search for “directory”.
Under "Directory" put a tick on “Directory.Read.All”
then on "ADD permissions".
Notice that the status of this permission shows "Not granted".
What we need to do now is click on "Grant admin consent" then confirm "Yes".
Your status will update to show granted.
Now that everything is set in the Azure side, we will configure the Central side.
Go to “Global Settings”, click on Directory Service, and click on the “Add Azure AD” button.
In the pop-up screen supply the relevant information and click on "Next".
In the "Settings" tab under the "Synchronization schedule" is where you can configure the frequency of the synchronization
Choosing none means that the synchronization will only occur at the time of your choosing.
Under "Configure Azure directory sync settings" enter the following.
The Azure "Application ID" in the "Client ID" space.
The domain you are synchronizing, the client secret and its expiration date.
Under the “Select users and groups to include in the synchronization”,
you can make the synchronization more granular based on group ID, group filter,
or user filter instead of all of them. We will discuss them later but for now I
will choose “All users and groups”. Now click on "Test connection".
This is compulsory whenever you make changes under "Configure Azure directory sync settings".
Once the connection is verified successfully, click on "OK".
"Save". Then turn it "On".
Now "Synchronize".
The status will show how many users and groups were synchronized.
And going to the People page you should see the Active Directory users listed.
Let us go back to the “Select users and groups to include in the synchronization”.
To modify the settings you will have to disable the synchronization first.
And anytime you're changing the Filter settings, you'll get this warning.
Aside from “All users and groups” which will synchronize all the users it finds within the AzureAD domain,
you can choose other filters which work best for your use.
Adding users by Group ID you just need to copy the Object ID of a particular group where the users belong to.
"Adding users by group" filter gives you more options to pick your intended users to synchronize.
For example, if you use the "Display Name", this is the group name.
Adding users by user filter, can be used to have more control on what to synchronize.
In this example we are using the Directory Sync Enabled PLUS User Type filter with an ALL logic,
meaning that we need to synchronize only the users that
are Member user type and are Directory Sync Enabled.
Directory Sync Enabled means that these users were synchronized from On-Premise AD.
Try using different options to synchronize the users and groups you
would like to appear in Sophos Central.
For the ones who have On-Premise AD users that need to be synchronized,
please use AzureAD Connect to synchronize them to AzureAD,
which is what Sophos AzureADSync communicates with.
Details are in the link within the description.
And that's it.
I hope you found this video useful.
Let us know by giving us a thumbs up in Techvids if you like this presentation.
Check out the documentation for this video in the video description.
For further assistance, view and post questions on community.sophos.com
and go to techvids.sophos.com for more great videos like this one.
Thanks for watching.