Sophos Mobile
13 Users
On the People page, you manage your Sophos Mobile user accounts.
User management
When you set up a customer in Sophos Mobile, you can choose between the following types of user management:
Internal user management
External user management
Federated authentication
You create user accounts in Sophos Mobile.
You create user accounts in an LDAP directory
(for example Active Directory) and then connect the LDAP directory to Sophos Mobile. See
Configure external directory connection (page
86).
You create user accounts in Azure Active
Directory (Azure AD). When users sign in to the
Self Service Portal, they authenticate with Azure
AD. See
Configure federated authentication (page
88).
User details
For internal user management, the People page shows the users you’ve added to Sophos Mobile.
For external user management and for federated authentication, the People page only shows users relevant for Sophos Mobile:
• Users assigned to a Sophos Mobile managed device.
• Users assigned to an Apple Volume Purchase Program (VPP) app.
Click a user’s name to view the account details.
Import users
For internal user management, you can import users from a CSV file. See
Import users
(page
90).
84
User groups
With user groups you control Self Service Portal access and available enrollment options. To create a Self Service Portal configuration for certain users only, add them to a user group and assign that
group to the Self Service Portal configuration. See Configure Self Service Portal (page 27).
For internal user management, you add users to groups in Sophos Mobile Admin. See Create user groups
(page 91).
For external user management, Sophos Mobile uses the groups defined in your LDAP directory.
For federated authentication, Sophos Mobile uses the groups defined in Azure AD.
Copyright © Sophos Limited
Sophos Mobile
13.1 Configure Self Service Portal user management
Note
For Sophos Mobile on Premise, user management for the Self Service Portal is configured by the super administrator when a customer is created. See the Sophos Mobile super administrator guide .
1. On the menu sidebar, under SETTINGS, click Setup > Sophos setup, and then click the User
setup tab.
2. Under Device assignment, select what happens when you delete a user that is assigned to a device:
Option
Unassign user from device
Unenroll and delete device
Unenroll device
Description
The user assignment is removed. The device status is not changed.
The device is unenrolled from Sophos Mobile and deleted.
The device is unenrolled from Sophos Mobile.
The device status is changed to Unenrolled.
This setting is not available when you use external user management.
3. Under User management mode, select how Sophos Mobile manages user accounts:
Option
None. No SSP, user-specific profiles, or
LDAP administrators available.
Internal directory
External LDAP directory
Azure AD federated authentication
Description
User management is turned off. You can’t assign users to devices and you can’t use the
Self Service Portal.
You create user accounts and user groups in
Sophos Mobile.
Sophos Mobile uses user accounts and user groups from an LDAP directory.
You create user accounts and user groups in Azure Active Directory (Azure AD). When users sign in to the Self Service Portal, they authenticate with Azure AD.
See Configure federated authentication
(page
88).
4. For external user management, click Configure external LDAP to configure the connection to your
LDAP directory.
See
Configure external directory connection (page 86).
5. Click Save.
After you’ve set the user management mode, you can’t switch directly to a different mode. Instead, select None. No SSP, user-specific profiles, or LDAP administrators available. to make all options available again.
Copyright © Sophos Limited 85
Sophos Mobile
Note
You can’t change the user management mode in the following situations:
• There are users assigned to devices.
• There are Apple Volume Purchase Program (VPP) licenses assigned to users.
13.2 Configure external directory connection
To manage user accounts for Sophos Mobile Admin and the Self Service Portal in an external LDAP user directory, you must configure the connection to your LDAP server.
Sophos Mobile can connect to the following LDAP servers:
• Active Directory
• Google Cloud Directory
• IBM Domino
• NetIQ eDirectory
• Red Hat Directory Server
• Zimbra
For supported versions, see the Sophos Mobile 9 release notes .
Note
There is no synchronization between the LDAP directory and Sophos Mobile. Sophos Mobile only accesses the LDAP directory to look up user information. Changes to an LDAP user account are not implemented on the Sophos Mobile database, and vice versa.
1. On the menu sidebar, under SETTINGS, click Setup > Sophos setup, and then click the User
setup tab.
2. Select External LDAP directory.
3. Click Configure external LDAP.
Configuration depends on the LDAP server type. The following instructions apply to Active Directory.
4. On the Server details page, configure the following settings: a) In the LDAP type field, select the LDAP server type.
b) In the Primary URL field, enter the IP address or name of the primary directory server.
Select SSL/TLS to secure the server connection by SSL or TLS (depending on what the server supports).
c) Optional: In the Secondary URL field, enter the IP address or name of a directory server
Sophos Mobile uses as fallback in case the primary server isn’t available.
d) In the User and Password fields, enter the credentials Sophos Mobile uses to authenticate with the LDAP server.
Use one of the following formats:
• <domain>\<user name>
• <user name>@<domain>.<domain code>
86 Copyright © Sophos Limited
Sophos Mobile
Note
For security reasons, we recommend you select an account with no write permissions for the directory.
5. On the Search base page, enter the distinguished name (DN) of the search base object.
The search base object defines the location in the directory from which the LDAP search begins.
6. On the Search fields page, configure the attributes of the directory service that contain the user properties Sophos Mobile uses.
Select the attribute names from the list or enter them manually.
Use the following mappings for Active Directory:
Property in Sophos Mobile
User name
First name
Last name
Attribute in Active Directory sAMAccountName givenName sn
Email mail
7. On the SSP configuration page, specify the users that are allowed to log in to the Self Service
Portal. Enter the relevant information in the LDAP directory group field, using one of the following options:
• If you enter the name of a group that is defined on the directory server, all members of that group are allowed to log in to the Self Service Portal. After you have entered the group name, click Test group to resolve the group name into a Distinguished Name (DN).
• If you leave the field empty, no users from the directory server are allowed to log in to the Self
Service Portal. Use this option if you want to enable external user management for Sophos
Mobile Admin but not for the Self Service Portal.
Note
The group you specify here is not related to the user group you define on the Group settings tab of the Self Service Portal page. With those settings, you define task bundles, Sophos
Mobile group membership and available device platforms for each user group.
8. Click Apply.
9. On the User setup tab, click Save.
Related information
How to connect a Sophos Mobile 8.0 server with an Azure Active Directory (Sophos knowledge base article 128081)
Connecting Sophos Mobile to Google Cloud Identity / Google Cloud Directory using Secure LDAP
(Sophos knowledge base article 132870)
13.3 Federated authentication
Federated authentication with Azure Active Directory (Azure AD) is an alternative user management mode to internal and external (LDAP) user management.
Copyright © Sophos Limited 87
Sophos Mobile
When users sign in to the Self Service Portal, there is a fundamental difference between external user management and federated authentication:
• With external user management, users authenticate with Sophos Mobile using their LDAP credentials.
• With federated authentication, users authenticate directly with Azure AD.
This has the following advantages:
• Azure AD supports modern sign-in features such as multi-factor authentication, smart card authentication, or certificate-based authentication.
• Cross-platform single sign-on: Users only sign in once to access the Self Service Portal and other applications and resources you’ve configured for Azure AD authentication.
• You don’t need to open ports 389 (LDAP) or 636 (LDAPS) for the communication between Sophos
Mobile and your LDAP server.
13.3.1 Configure federated authentication
To use federated authentication with Azure Active Directory (Azure AD), you must register Sophos
Mobile as a Microsoft Azure application.
1. On the menu sidebar, under SETTINGS, click Setup > Sophos setup, and then click the
Microsoft Azure tab.
2. Click Microsoft Azure registration wizard.
The wizard guides you through the registration process in the Microsoft Azure portal and in Sophos
Mobile Admin: a) Create an application for Sophos Mobile in the Microsoft Azure portal.
b) Enter the application ID in Sophos Mobile.
c) Upload the Sophos Mobile server certificate to your application.
d) Register a reply URL for Sophos Mobile. Azure forwards users to this Sophos Mobile page after they’ve authenticated with Azure AD.
e) Grant your application the required permissions.
3. On the Sophos setup page, click the User setup tab.
4. Select Azure AD federated authentication as user management mode.
If federated authentication is not available, switch to None. No SSP, user-specific profiles, or
LDAP administrators available. first.
Note
You can use the application for Sophos Mobile you’ve created in the Azure portal also for Intune app protection. Note that Intune app protection has additional licensing requirements. See
Intune app protection
(page 323).
88 Copyright © Sophos Limited
Sophos Mobile
13.3.2 Set a default customer for the Self Service Portal
As super administrator, you can set a default customer that is automatically selected when users access the Self Service Portal.
In Sophos Mobile you can set up several customers to manage different areas of your organization independently of each other. When users access the Self Service Portal, they have to select their customer before they enter their credentials.
You can simplify the sign-in experience by setting a default customer. While this is possible for all user management modes, it’s particularly useful for federated authentication: Users don’t see a signin page at all if they’ve already authenticated with Azure Active Directory (Azure AD).
To set a default customer for the Self Service Portal:
1. Sign in to Sophos Mobile Admin with a super administrator account.
2. On the menu sidebar, under SETTINGS, click Setup > Sophos setup, and then click the Web
portals tab.
3. Under Self Service Portal, select Default customer and select a customer from the list.
4. Optional: Turn off Visible and editable to skip the sign-in page if the user has already authenticated with Azure AD.
Note
If you turn this off, only users of the default customer can access the Self Service Portal.
5. Click Save.
13.4 Configure LDAP connection
If you’ve set up federated authentication you can configure an LDAP connection between Sophos
Mobile and Azure Active Directory (Azure AD). You must do this if you want to use Apple DEP, Google zero-touch, or Samsung KME.
The following devices enroll automatically with Sophos Mobile when users set them up:
• iPhones, iPads, and Macs registered for the Apple device enrollment program (DEP)
• Android devices registered for Google zero-touch enrollment
• Samsung Android devices registered for Knox Mobile Enrollment (KME)
During the enrollment process, Sophos Mobile connects to Azure AD to authenticate the user.
To configure an LDAP connection:
1. On the menu sidebar, under SETTINGS, click Setup > Sophos setup, and then click the LDAP
connection tab.
2. Click Configure external LDAP.
3. On the Server details page, configure the following settings: a) In the Primary URL field, enter the IP address or name of the primary directory server.
The server must support LDAPS (LDAP over SSL/TLS).
b) Optional: In the Secondary URL field, enter the IP address or name of a directory server
Sophos Mobile uses as fallback in case the primary server isn’t available.
Copyright © Sophos Limited 89
Sophos Mobile c) In the User and Password fields, enter the credentials Sophos Mobile uses to authenticate with the LDAP server.
Use one of the following formats:
• <domain>\<user name>
• <user name>@<domain>.<domain code>
Note
For security reasons, we recommend you select an account with no write permissions for the directory.
4. On the Search base page, enter the distinguished name (DN) of the search base object.
The search base object defines the location in the directory from which the LDAP search begins.
5. Click Apply.
13.5 Create users
1. On the menu sidebar, under MANAGE, click People.
2. Click Create user.
3. On the Edit user page, select the Send registration email check box.
4. Enter the account details.
The User name field must only contain letters (Latin alphabet), digits, spaces and the characters
\!._-# .
5. Click Save.
A registration email is sent to the new user.
If you click the blue triangle next to the required user, you can view the user details (Show), Edit or
Delete the user.
Note
If you click a user name, the Edit user page is displayed. This page contains the Resend
registration email button, which you can use to send the email again if the user did not receive or lost the initial email.
13.6 Import users
You can add users by importing them from a CSV file.
You can import up to 500 users.
If you specify a group that doesn’t exist, Sophos Mobile creates it.
The CSV file must have the following specification:
• The first row is treated as a header and is not imported.
• Values must be separated by semicolon, not by comma.
• All rows must have the correct number of semicolon characters, even if you leave out optional values.
90 Copyright © Sophos Limited
Sophos Mobile
• The file extension must be .csv
.
• To ensure that non-English characters are imported correctly, the file must be UTF-8 encoded.
Tip
On the Import users page, click Example CSV to download a sample file.
To import users from a CSV file:
1. On the menu sidebar, under MANAGE, click People.
2. Click Import users.
3. On the Import users page, select Send registration emails.
4. Click Upload a file and then navigate to the CSV file you have prepared.
The entries are read in from the file and are displayed.
5. If the data is not formatted correctly or is inconsistent, the file as a whole cannot be imported. In this case, follow the error messages that are displayed next to the relevant entries, correct the content of the CSV file accordingly and upload it again.
6. Click Finish to create the user accounts.
The users are imported and displayed on the People page. They receive emails with their login credentials for the Self Service Portal.
13.7 Create user groups
With user groups you control Self Service Portal access and available enrollment options.
Note
If you manage your user accounts in an external LDAP directory, create your user groups there.
If you use federated authentication, create your user groups in Azure Active Directory.
To create a user group:
1. On the menu sidebar, under MANAGE, click People.
2. Click Show user groups.
3. On the Show user groups page, click Create group.
4. Enter a name for the group.
5. Click Save.
After you’ve created a user group, you can add users to it.
When you assign the group to a Self Service Portal configuration, that configuration only applies to the group members. See
Configure Self Service Portal
(page 27).
Copyright © Sophos Limited 91
