Manage Sophos Endpoint agent mode and software
Sophos Fusion (formerly Sophos Central) manages the product scope of an already registered computer through Actions > Manage software. The agent mode is the first important decision. It determines whether Sophos provides protection or only detection and response data alongside a third-party product.
The former dialogue with separate columns for “Endpoint Protection” and “Intercept X” no longer reflects the current model. Agent mode and other licensed products are now managed directly in the unified device view. The quick path is: My Environment > Computers & Servers, select the target devices, open Actions > Manage software, choose the intended state and confirm with Start job.
Agent modes
| Agent mode | Sophos protection | Detection and response | Third-party antivirus required |
|---|---|---|---|
| Endpoint | yes | no | no |
| XDR | yes | yes | no |
| XDR Sensor | no | yes | yes |
⚠️ XDR Sensor does not protect against malware. It must only be used when a separate, working protection product is present. Switching from XDR Sensor to Endpoint or XDR can remove existing third-party protection.
The available modes depend on the licence, operating system and device type. Sophos states that detection and response features require an XDR or MDR licence; according to the current help, the separate XDR Sensor installer requires a licence that includes XDR.
Unresolved MDR conflict: The MDR installation help still names MDR Essentials for XDR Sensor, while the service overview names MDR and MDR Plus. This does not confirm sensor entitlement for every current tier. The MDR Windows instructions also use mdr, but the Windows CLI product list does not include it. Do not declare it invalid or replace it with xdr or xdrsensor.
Before assigning an MDR sensor, confirm the contracted tier/SKU, active tenant licence, platform and installation path with Sophos or the responsible partner; stop the change if anything is unclear. The Windows product value requires written confirmation for the installer version and software scope. A visible option alone does not confirm entitlement. After an approved pilot change, check Agent mode, Agent mode status (Installed), local components and continued working third-party protection; these checks do not replace MDR service acceptance. The deployment guide explains the preflight clarification point.
Endpoint includes Sophos protection. XDR combines that protection with detection and response. XDR Sensor provides detection and response only and replaces neither anti-malware protection nor the third-party product. Configure blanket mutual exclusions only for a specifically confirmed compatibility issue.
Check the software scope
Under My Environment > Computers & Servers, the Agent mode and Agent mode status columns and filters show the current state.
The most relevant values are:
Product unassigned: licensed software has not yet been assigned to the device.Upgrade available: additional licensed features can be installed.Installed: the intended agent mode is installed.Not Supported: the product or mode is not supported on this device.
The Account Health Check reports devices that do not match the available licences. An automatic fix can distribute all licensed software to many devices, so it must first be checked against the intended operating model. Sophos records these changes in the audit log.
Change software on a device
- Open My Environment > Computers & Servers.
- Select one or more similar devices.
- Select Actions > Manage software.
- Choose the intended mode under Protection.
- Change other displayed product rows, such as Encryption, ZTNA or DNS & ZTNA, only after checking the licence, platform and existing use.
- Confirm with Start job.
- Wait until the devices are online and update.
Sophos states that installation during the next online and update cycle usually takes about an hour. This is not a guaranteed deadline. Offline devices apply the change only after their next contact.
Checks before switching
A product switch is a software change and requires the same care as a rollout:
- target mode and licence are documented
- the pilot group contains representative devices
- existing third-party protection is considered
- a maintenance window and possible restart are planned
- disk encryption and recovery keys are checked
- proxy, update cache and download path work
- business applications are tested after the switch
In particular, switching from XDR Sensor to Endpoint or XDR can remove competing protection. Without a pilot, this can temporarily produce duplicate or missing protection.
Additional components and shared product rows
Additional products appear only when the licence and platform are suitable. For selected computers, displayed components such as Encryption and ZTNA can be set to Install or Uninstall; Sophos Fusion shows unsupported combinations as Not Supported. For selected servers, Actions > Manage software only offers Protection.
Before deploying Device Encryption, check at least the TPM or FileVault requirements, user assignment, recovery-key process and any existing BitLocker or FileVault configuration. A visible plus button is not a rollout plan.
Take particular care with DNS & ZTNA. This shared label does not mean that the DNS component can be removed or repaired separately. The officially documented DNS integration supports Windows endpoints only and requires an existing Endpoint agent and the Windows > Recommended package. The current configuration guide calls the row DNS, or DNS & ZTNA when a ZTNA licence is present. Configure Sophos DNS Protection for endpoints covers installation, policy and functional validation.
If only DNS Protection must be stopped, first disable the DNS endpoint policy or remove its device assignment, then verify normal name resolution. Do not change DNS & ZTNA until you have confirmed that the device does not need ZTNA. The linked configuration guide does not describe a DNS-only uninstall, DNS-only repair or local DNS component version, so none of these procedures can be inferred from the shared row.
Remove software
Actions > Manage software can remove displayed product components or change the agent mode. A component action does not automatically remove the complete local Sophos agent. For agent mode, the option is Uninstall current protection. The Sophos Core Agent remains installed so that Sophos Fusion can continue to manage the device and assign software later. Before changing agent mode, review the Sophos Endpoint update and change process and assess the agent changes.
This is not a complete uninstall. For final offboarding on Windows, follow Uninstall Sophos Endpoint on Windows; other operating systems require their platform-specific removal procedure.
Validate the change
After assignment, check Sophos Fusion and the device:
- Agent mode status shows
Installed. - Every changed product row shows the intended assignment and no pending installation state.
- The expected policies apply on the Policies tab.
- Locally, About shows the expected components and versions.
- Health state and last activity are plausible.
- Third-party protection is correctly present or removed for the target mode.
- No installation, update or restart alerts remain open.
A green health state alone does not confirm the correct agent mode.
Common problems
The change remains pending
Check last activity, network, proxy, update cache, free disk space and pending restarts. An offline device cannot apply a software assignment.
XDR features are missing
Check the licence, agent mode and platform together. Endpoint includes protection but not the full XDR feature set. XDR must be assigned and installed as the agent mode.
Third-party antivirus was removed
This can happen when switching to Sophos protection. Only XDR Sensor is intended for detection alongside a separate protection product. The target mode must be unambiguous before a bulk change.
Manage software does not remove everything
This is expected. With Uninstall, Sophos Fusion removes the protection components but leaves the Core Agent installed for communication and policy management. Use the linked uninstall procedure for complete removal.
DNS and ZTNA appear in one shared row
Do not set the row to Uninstall as an experiment. First check whether ZTNA is in use. For DNS-only rollback, withdraw the DNS endpoint policy and validate the result; for further component cleanup, use the Sophos process confirmed for the tenant.