Description
Sophos Identity Threat Detection and Response ITDR - 1 year (50-99 users and servers)
Sophos ITDR (Identity Threat Detection and Response) watches your Microsoft Entra ID and Active Directory accounts for stolen credentials, risky settings and account takeover, and can lock an account or force a password reset when something looks wrong. This listing covers 50-99 users and servers for 1 year, Sophos part number ITDR0U12ADNCAA.
- Part numberITDR0U12ADNCAA
- Licensed perUsers and servers, 50-99
- Term1 year
- CoversEntra ID and Active Directory
- Works withSophos XDR or MDR
Who it is for
Microsoft 365 business
Your staff sign in with Entra ID. ITDR checks those accounts and settings and spots sign-ins that do not fit.
Passwords may have leaked
Scans the dark web and breach databases for your users' credentials, with closer watch on VIP accounts.
MFA is on, but is it enough?
MFA protects the sign-in. ITDR watches what happens after it, where token theft and session hijacking happen.
What is included
- 160+ identity posture checks for exposed credentials, misconfigurations and risky authentication settings.
- Dark web and breach monitoring for leaked or stolen credentials, with enhanced monitoring of VIP accounts.
- User behavior analytics that flag activity tied to stolen credentials and insider threats.
- Response actions: force a password reset or lock an account showing suspicious behavior. With Sophos MDR, analysts can also revoke active sessions.
- Identity risk scores and case management in Sophos Fusion, including monitoring of non-human identities.
Why MFA is not the whole answer: multi-factor authentication protects the sign-in event. It does not stop token theft, session hijacking or misuse by an account that has already signed in. ITDR covers what happens after the login succeeds.
Where it fits
- Sophos XDR or Sophos MDR. Sophos lists ITDR as an add-on for these.
- Sophos ITDR (this listing). Adds identity posture checks, leaked-credential monitoring and identity threat detection.
- Sophos NDR. Adds network visibility for devices that cannot run an agent.
Choose the band by the number of users and servers you protect with Sophos, the same way as your XDR or MDR license.
All bands and terms
| Users and servers | 1 year |
|---|---|
| 1-9 users and servers | View |
| 10-24 users and servers | View |
| 25-49 users and servers | View |
| 50-99 users and servers | This listing |
| 100-199 users and servers | View |
| 200 or more | Ask Nuformat for a quote, priced to your exact count |
Frequently asked questions
What does Sophos ITDR cover?
Microsoft Entra ID and on-premises Active Directory. It assesses identities across both, checks for risky settings and leaked credentials, and detects identity attacks.
Does MFA make ITDR unnecessary?
No. MFA raises the bar at sign-in but does not prevent token theft, session hijacking or abuse by an account that has already signed in. ITDR covers behavior after authentication.
Do I need Sophos XDR or MDR?
Sophos lists ITDR as an add-on for Sophos XDR and Sophos MDR in its tech specs, and it is fully integrated with both. Ask us if you run neither.
What does this listing cover?
50-99 users and servers for 1 year, Sophos part ITDR0U12ADNCAA.
Can I pay monthly instead of for a full term?
Yes. Nuformat can bill Sophos ITDR monthly as your managed service provider. Monthly rates can change, so a term subscription is the way to fix your price.
Get Sophos ITDR quoted by Nuformat
Nuformat is a Sophos partner serving Canada and the United States. Tell us your user and server counts and if you use Entra ID, Active Directory or both, and we will confirm the band.
Request a quoteFeatures as listed on the Sophos ITDR product page and Sophos Endpoint tech specs on sophos.com, checked October 11, 2026. Pricing and availability confirmed by Nuformat at quotation. All Sophos ITDR options