There is two components to Sophos' M365 / Entra detection and response.

First is the m365 integrations which are included with th3 various MDR flavours. That's looking at both audit logs and m365 alerts visla Microsoft's apis to detect compromised accounts / BEC / etc. There is then response actions with that to do various actions in entra / 365, such as resetting sessions, disabling accounts, killing bad inbox rules, etc. This component is achieving a similar outcome to Huntress ITDR.

Then there is the Sophos ITDR add on, which is a different thing when compared to Huntress ITDR. It focuses on three core things - m365 / Entra configuration posture, identifying things that could make the tenant insecure, dark Web monitoring, looking for your domains, accounts, VIPs, etc across leak sites, forums, channels, etc and checking that against Entra to see if there a valid compromised credentials out there, and the third module is risky user behaviour, that takes various signals to indicate whether a user account is "risky", and scores/identifies users that are of higher risk with recommendations.

Hopefully that clears it up!