Overview

Torii integrates with Sophos Central and syncs:

• Sophos Central console administrators (the people who sign in to Sophos Central), including email, first and last name, role names and creation date.
• You can constantly stay updated with application information from our Integrations Page >> Integration Capabilities button >> Integration Capabilities table.

Directory (protected) users, Sophos license usage and last login information are not synced. In Torii, each administrator is shown with one Sophos Central license.

Requirements

To connect this integration, we require the following:

Accounts & Permissions

• A Sophos Central account with the Super Admin role (required to create API credentials).
• A tenant-level API credential. Partner and organization credentials are not supported; each connection is a single tenant.
• An API credential with the Service Principal Read-Only role is enough to sync. To use the Remove user and Change Sophos Central admin role actions, give the credential the Service Principal Management or Service Principal Super Admin role.

Required keys

• Client ID - of the API credential.
• Client Secret - of the API credential.
• Tenant ID - your Sophos Central tenant identifier.
• Data Region URL - the API host of your tenant's data region, for example https://api-us03.central.sophos.com.

How to Generate the Required Values

Step 1: Create an API credential

1. Sign in to Sophos Central (https://central.sophos.com/manage) as a Super Admin.
2. Click Global Settings, go to Access Control and click API Credentials.
3. Click Add Credential. Enter a name (for example, Torii) and a description, choose the role from Accounts & Permissions above, then click Add.
4. Click Copy to note down the Client ID.
5. Show the client secret and click Copy to note down the Client Secret.

Step 2: Find your Tenant ID and Data Region URL

1. Get an access token by running the following command, replacing the placeholders with your Client ID and Client Secret:

   curl -X POST https://id.sophos.com/api/v2/oauth2/token \
     -H "Content-Type: application/x-www-form-urlencoded" \
     -d "grant_type=client_credentials&client_id=<CLIENT_ID>&client_secret=<CLIENT_SECRET>&scope=token"

2. Copy the access_token value from the response and run:

   curl https://api.central.sophos.com/whoami/v1 \
     -H "Authorization: Bearer <ACCESS_TOKEN>"

3. In the response, copy the id value. This is your Tenant ID.
4. Copy the apiHosts.dataRegion value (for example, https://api-us03.central.sophos.com). This is your Data Region URL. Do not add a trailing slash.

How to Connect the Integration

1. Go to the Integrations page in Torii.
2. Search for Sophos Central and click Connect.
3. Enter the Account Name, Client ID, Client Secret, Tenant ID and Data Region URL.
4. Click Connect.

Actions

• Remove user - removes the administrator from Sophos Central. Removing the last Super Admin is not allowed by Sophos.
• Change Sophos Central admin role - sets the administrator's role. Any existing role assignment is replaced by the selected role.

Creating users is not supported.

Q&A

Q: What should I enter in the "Account Name" field?

A: The Account Name field lets you connect multiple Sophos Central accounts to Torii. The value can be anything you choose. It is only used to distinguish between your connected accounts. Make sure to use a unique Account Name for each account: connecting a different account with an Account Name that is already in use will overwrite the existing account's data, so choosing distinct names is your responsibility.

For any further questions, please contact Torii Support.