The Sophos integration enables security and compliance teams to automate User Access Reviews (UAR) by syncing user account data directly from Sophos. This helps organizations review which users have access to Sophos and maintain accurate access records for compliance monitoring.
Key Capabilities
User Access Monitoring: Retrieve Sophos user accounts for access review workflows
Access Visibility: Monitor which users have access to your Sophos environment
Compliance Monitoring: Maintain auditable records of system access for compliance and security governance
This integration supports User Access Review workflows, helping organizations demonstrate compliance with access control policies.
Prerequisites & Data Access
Sophos Access Requirements
You must have Administrator privileges in your Sophos account.
You will need the following values:
Tenant ID
API Host
Client ID
Client Secret
Drata Role Requirements
To create or modify connections, you must have one of the following Drata roles with write access:
Admin
Workspace Manager
DevOps Engineer
Access Reviewers can view the connection page but cannot modify connection settings.
Step-by-Step Setup
Step 1: Retrieve Your Sophos Tenant ID
Log in to your Sophos account.
Select your profile icon in the top-right corner.
Navigate to Support Settings.
Locate the Tenant ID near the bottom of the page.
Copy the Tenant ID.
Expected outcome:
You have copied the Sophos Tenant ID required for the integration.
Step 2: Identify Your Sophos API Host
On the same Support Settings page, locate your region.
The page will display:
“This account is located in the <Region> region.”Use the region to identify the correct API Host from the Sophos API documentation:
https://developer.sophos.com/intro#global-vs-regional-apisCopy the API Host that corresponds to your region.
Expected outcome:
You have identified and copied the correct API Host for your Sophos environment.
Step 3: Create Sophos API Credentials
Navigate to the Sophos API Credentials Management page.
Select Add Credential.
Enter the credential details.
Set the role to:
Service Principal ReadOnly
Select Show Client Secret.
Copy the following values:
Client ID
Client Secret
Store these credentials securely.
Expected outcome:
You have generated the Client ID and Client Secret required for the integration.
Step 4: Connect Sophos in Drata
Log in to Drata → go to the Connections page.
Navigate to your Available Connections.
Search for and start the Sophos connection process.
Enter the following information when prompted:
Tenant ID
API Host
Client ID
Client Secret
Expected outcome:
Sophos is successfully connected and user access data begins syncing to Drata.
Important Notes
Authentication method: The Sophos integration uses API credentials.
Credential security: Store the Client ID and Client Secret securely according to your organization’s security policies.
Network restrictions: If your organization uses a Web Application Firewall (WAF), ensure required Drata IP addresses are allowlisted so the connection can be established.