Build Sophos Central Endpoint policies correctly

Sophos Central applies exactly one matching policy for each feature. Central checks the list from top to bottom; the first policy that is active and matches the user or computer wins. The Base Policy is always at the bottom and catches every target not covered by a policy above it.

This also establishes the key boundary: policies of the same type are not merged into one effective configuration. This foundation article therefore explains assignment, scope and order. The linked detail articles cover the settings of individual policy types.

The Endpoint onboarding path covers the complete journey from planning through operational handover.

The model in four rules

1. A policy belongs to one licensed feature, such as Threat Protection, Application Control or Web Control.
2. A policy contains all settings for that feature. An endpoint does not take individual switches from several policies of the same type.
3. Its scope is defined by the assigned users, user groups, computers or computer groups. The available target types depend on the policy type.
4. If several active policies of the same type match, only their position decides: the first matching policy is applied.

Rule of thumb: Put specific policies at the top and general policies further down.

The word “inheritance” can be misleading here. At runtime, an additional policy does not take some values from the Base Policy and add others. It can override Base Policy settings for its scope, but the complete first matching policy is effective for that policy type.

Base Policy and additional policies

Sophos provides a Base Policy for every feature. It is always available, cannot be disabled or deleted and remains at the bottom of the list. Initially it applies to all users and devices or, for server policies, all servers.

For features such as Threat Protection, Sophos supplies the Base Policy with best-practice settings. For network-specific features such as Application Control or Peripheral Control, you must configure the feature for your own environment.

Additional policies are only needed when a target group requires different settings. The Base Policy alone may be enough for a uniform configuration. Every additional policy increases the potential for overlaps, however, so give it an unambiguous purpose and scope.

Choose a user or computer scope

A user policy applies to all managed devices used by that user. A computer policy applies to specific computers or computer groups, regardless of who signs in. Some features support both variants; others support only one. According to Sophos, Update Management can, for example, be configured for computers but not users.

If a user policy and a computer policy for the same feature both match, neither target type has automatic priority. Their order in the policy list still decides.

Groups are an assignment aid, not another policy layer. The Policies tab for a computer group shows the policies enabled and applied to that group. Editing a linked policy there also affects every other group to which the same policy is assigned.

Plan order and overlaps

A maintainable order starts with the narrowest scope and ends with the broadest. A simple example with three active Threat Protection policies:

A Finance laptop receives position 1. Another workstation receives position 2. If TP-All-Workstations were at the top, this general policy would already match and the Finance policy would never apply.

Avanet recommendation: Where possible, use the Base Policy as the production standard. Put only justified deviations above it, such as a small pilot group or a tightly scoped technical exception. A separate policy for every department is only useful when the settings genuinely differ.

Create and assign a policy

The official workflow starts on the product page:

1. Open My Products and select Endpoint.
2. Open Policies and select Add Policy.
3. Select the feature and, if offered, the Endpoint policy type.
4. On the details page, assign the intended users or devices.
5. Configure the settings for the selected policy type.
6. Enable and save the policy.
7. Drag it to the required position in the policy list.

Before a broad rollout, assign a new policy only to a small pilot group. A name such as TP-Pilot-2026Q3 exposes its feature, purpose and time context. The actual feature settings belong in the relevant detail article, for example Threat Protection, Application Control, Peripheral Control or Web Control.

The Data Collection and Investigation policy demonstrates the scope principle particularly clearly: its Base Policy applies to all devices by default. To give specific devices different settings, put them in a computer group and assign an additional policy. This article deliberately does not repeat the settings for Live Response, Data Lake uploads or exclusions.

Verify the policy actually applied

A correct list does not prove which policy a specific computer receives. The direct verification path is:

1. Open My Environment > Computers & Servers. Alternatively, use My Products > Endpoint > Computers.
2. Open the computer.
3. Select the Policies tab.
4. Check the applied policy name for each feature.

Clicking a policy name opens its details. Changes there affect all users or devices to which that policy is assigned. Check the scope and overlaps before editing it.

For a computer group, go to My Products > Endpoint > Computers > Computer Groups, select the group and then select Policies. This shows which policies are enabled and applied to the group.

If the expected policy does not appear

Check in this order:

1. Policy type: Are you comparing policies for the same feature?
2. Active state: Is the expected policy enabled and not expired?
3. Scope: Is the user, computer or correct group actually assigned?
4. Order: Does a more general policy above it already match?
5. Effective policy: Which name appears on the computer’s Policies tab?

An agent update cannot correct the wrong order or assignment. Only when Central shows the correct policy as applied should missing enforcement move to component-specific endpoint diagnostics.

Frequently asked questions

Official sources

• Sophos Central Admin: About Policies – policy model, Base Policy, target types and priority.
• Sophos Central Admin: Create or Edit a Policy – official workflow for creation, assignment, settings and active state.
• Sophos Central Admin: Computer Policies – verifying policies applied to a computer.
• Sophos Central Admin: Computer Group Policies – verifying policies enabled and applied to a computer group and the effect of editing a shared policy.
• Sophos Central Admin: Data Collection and Investigation policy – assigned Endpoint source and an example of Base Policy and device-based scope.