In short: Sophos MDR for Microsoft Defender means using Sophos's 24/7 MDR service on top of the Microsoft security tools you already have. Sophos ingests Microsoft 365 audit logs and Microsoft Graph security alerts at no extra cost, investigates them, and can block sign-ins, revoke sessions and disable inbox rules in Microsoft 365.
What is Sophos MDR for Microsoft?
Many UK organisations already own Microsoft Defender through Microsoft 365 Business Premium or an E3 or E5 plan. Defender generates good alerts, but someone still has to read them, decide which matter and respond, including at night and at weekends. That is the gap Sophos MDR fills.
Sophos MDR is listed by Microsoft as a verified solution for small and medium businesses through the Microsoft Intelligent Security Association (MISA), which validates its integration with Microsoft Defender for Endpoint and Defender for Business. Sophos says it protects organisations on Microsoft 365 Business Basic, Standard and Premium, E3 and E5, although the alerts available depend on your plan.
This page is about running Sophos MDR on top of Microsoft. If you are deciding whether to replace Defender with Sophos Endpoint, see Sophos Endpoint vs Microsoft Defender for Business.
What Sophos ingests from Microsoft
Two Microsoft integrations are included with Sophos MDR at no additional cost, subject to your Microsoft subscriptions:
- Microsoft 365 audit logs (user activity in Microsoft 365)
- Microsoft Graph security API, which passes Microsoft security alerts to Sophos for analysis
Through the Graph security integration, Sophos can receive alerts raised by these Microsoft services, where your licences include them:
| Microsoft source | Typical alerts |
|---|---|
| Microsoft Defender for Endpoint / Defender for Business | Malware, suspicious processes and attacker techniques on devices |
| Microsoft Defender for Office 365 | Phishing, malicious attachments and links |
| Microsoft Defender for Identity | Suspicious activity against on-premises Active Directory |
| Microsoft Defender for Cloud Apps | Risky cloud app use and anomalous behaviour |
| Microsoft Entra ID Protection | Risky sign-ins |
| Microsoft Purview Data Loss Prevention and Insider Risk Management | Data handling and insider risk alerts |
One gap to know about: Entra ID risky users and service principal risk events need Entra ID event logs, which come through the Sophos ITDR integration rather than the Graph security feed. Many organisations add ITDR for that reason.
Response actions in Microsoft 365
Watching is only half the job. With the Microsoft 365 Response Actions integration, Sophos analysts can act in your tenant to stop an account takeover:
- Block (or re-allow) a user's sign-in
- Disconnect and revoke all of a user's current sessions
- Turn off a user's inbox rules, a common trick for hiding attacker activity or forwarding mail
Setting it up needs a Microsoft 365 administrator to sign in and accept the permission prompts for the Sophos Fusion Integration app. Sophos says no Microsoft licence is needed for the response integration itself, and you can configure only one response actions integration, covering one Microsoft 365 environment, so choose your primary tenant. Sophos respects the threat response mode in your MDR settings, so if you choose to collaborate, analysts agree actions with you first.
Two practical points: in hybrid environments using Entra Connect Sync, an account disabled in the cloud can be re-enabled by the next sync, so on-premises accounts need attention too; and the integration credential can be suspended if left unused, with warnings shown in the console. After your tenant moves to Sophos Fusion, check that the Microsoft integrations still show as healthy and act on any prompts. We do that check for the customers we support.
Endpoint options: keep Defender, or add Sophos Endpoint
| Option | How it works with Sophos MDR |
|---|---|
| Keep Microsoft Defender for Endpoint or Defender for Business | Sophos analyses Defender alerts through the Microsoft integrations, and the Sophos agent can run in detection and response-only mode for extra visibility |
| Switch to Sophos Endpoint | Sophos Endpoint protection is included with Sophos MDR at no extra cost, adding Sophos's prevention, including CryptoGuard ransomware rollback |
| Keep another vendor's endpoint product | The Sophos agent runs in detection and response-only mode alongside it, with no conflicting protection actions |
Whichever you choose, the Microsoft 365 integrations still apply, so email, identity and cloud app alerts are covered. See Sophos CryptoGuard for how Sophos's anti-ransomware differs from Defender's.
Who it suits
- Microsoft 365 Business Premium organisations that want to get value from Defender for Business without hiring a security team
- E3 and E5 customers whose Defender and Entra alerts are not reviewed out of hours
- IT teams that have standardised on Microsoft and do not want to swap endpoint agents
- Organisations that want one team across Microsoft and non-Microsoft tools, including firewalls, email gateways and identity
For a broader look at hardening Microsoft 365 itself, see our Microsoft 365 security guide, or ask for a Microsoft 365 security assessment.
How we help
We check what your current Microsoft licences actually give you, connect the Microsoft 365 audit log, Graph security and response action integrations, agree the response mode, and decide with you whether to keep Defender or move to Sophos Endpoint. We can also review your Microsoft licensing so you are not paying twice for overlapping security features.
Sophos MDR and Sophos MDR Plus both work this way. Pricing depends on your users, servers and term, so contact us and ask us for a quote.
How Forever Systems supplies and supports Sophos
We supply and support the Sophos portfolio for UK organisations, from a single Sophos Endpoint (Intercept X) licence to a fully managed Sophos estate across endpoint, server, firewall, email, network and managed detection and response.
- Scoping and licensing: the right products, tiers and add-ons for your users, servers and risk, and a clear view of how the old Intercept X names map to today's Sophos Endpoint, EDR, XDR and MDR
- Deployment and migration from other endpoint, firewall or email products, or from older Sophos products and on-premises consoles
- Policy tuning so protection is strong without blocking legitimate work
- Ongoing support: alerts, health checks, updates, renewals and licence true-ups in Sophos Central (now becoming Sophos Fusion)
Forever Systems Ltd is an independent IT and cyber security provider. We also supply alternatives such as Cisco Secure Endpoint and Check Point Harmony Endpoint, so our advice is impartial.
Want a Sophos quote, trial or renewal review?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Does Sophos MDR work with Microsoft Defender?
Yes. Sophos MDR ingests Microsoft security alerts through the Microsoft Graph security API and Microsoft 365 audit logs, and its integration with Defender for Endpoint and Defender for Business is validated by Microsoft through MISA.
Do I have to replace Microsoft Defender to use Sophos MDR?
No. You can keep Defender. Sophos Endpoint is included with Sophos MDR at no extra cost if you want it, but it is optional.
What actions can Sophos take in Microsoft 365?
With the Microsoft 365 Response Actions integration, Sophos can block or allow user sign-in, revoke a user's current sessions and turn off inbox rules, within the threat response mode you have chosen.
Which Microsoft licence do I need for Sophos MDR?
Sophos supports Microsoft 365 Business Basic through to E5, but the security alerts Sophos receives depend on the Microsoft services you are licensed for. The response actions integration has no Microsoft licence requirement of its own.
Is there an extra charge for the Microsoft integrations?
No. Sophos includes the Microsoft 365 audit log and Microsoft Graph security integrations with Sophos MDR at no additional cost.