Build Sophos Central Endpoint policies correctly
Sophos Central does not arbitrarily combine settings from different policies of the same type. For each type, such as Threat Protection, Web Control or Update Management, Central searches from top to bottom and applies the first active policy whose target matches the user or device.
This simple rule explains many apparent agent problems. The intended policy exists, but a more general policy above it takes precedence.
The policy model
Every feature has a Base Policy. It is always last, cannot be deleted or disabled and applies when no more specific policy matches.
Additional policies can be deleted, but Sophos Central cannot restore them. Before deletion, export or clearly document the settings, target group, priority, and reasons for any exceptions.
Additional policies replace the Base Policy completely for their target within that policy type. Threat Protection settings are not merged from several policies. Exactly one first matching Threat Protection policy, one first matching Web Control policy and so on applies.
Rule of thumb: Put specific policies at the top and general policies below them.
User or computer policy?
A user policy follows the user across managed devices. A computer policy applies to the device regardless of who signs in. Not every policy type supports both targets.
| Requirement | Usually suitable target |
|---|---|
| same protection for a kiosk or production PC | computer or computer group |
| web rules follow a person across devices | user or user group |
| staged software updates | computer group |
| critical exception on one device | individual computer, time limited |
If a user and computer policy of the same type both match, list order still decides. The target type has no automatic priority.
A maintainable baseline
A good model has only as many exceptions as operations genuinely require:
- Base Policy: secure defaults for all devices.
- Pilot: small, supported group for new settings and software stages.
- Production: only when the Base Policy is not already the production standard.
- Critical systems: documented exception for incompatible or sensitive systems.
- Temporary exception: time-limited troubleshooting with an owner and expiry date.
A separate policy for every department or device quickly creates overlaps. A small set of clear target groups and a documented reason for every exception works better.
Introduce a new policy safely
Select the required type under My Products > Endpoint > Policies, then:
- define its purpose and measurable objective
- compare the existing Base Policy and higher policies
- create a policy with a meaningful name
- assign only the pilot group
- enable it and move it to the correct position
- verify the Policies tab on a pilot device
- observe events, alerts, user impact and performance
- expand the target group only after validation
A name such as TP-Pilot-HTTPS-Decrypt-2026Q3 is more useful than New Policy 2 because it states function, purpose and context.
Priority example
Assume three Threat Protection policies are active:
| Position | Policy | Target |
|---|---|---|
| 1 | TP-Finance-Exception | Finance group |
| 2 | TP-All-Workstations | all workstations |
| 3 | Base Policy | everything else |
A Finance laptop receives position 1. Another workstation receives position 2. The Base Policy applies only to devices that neither policy covers.
If TP-All-Workstations were first, the Finance exception would never apply.
Check the effective policy
Do not check the configuration only in the policy list:
- Open My Environment > Computers & Servers.
- Select the device.
- Open the Policies tab.
- Verify the applied name for every policy type.
- Consider the time of the last activity.
An offline device receives a changed assignment only after its next contact. For user policies, also verify the last signed-in user.
Verify policy receipt, not only assignment
The assignment in Central describes the intended state. For a policy to take effect, the Management Communication System, or MCS, must be installed and working on the Endpoint. Last Active is a useful indicator, but according to Sophos it is updated no more than once an hour.
New policies and commands such as Update, Scan or Cleanup are normally retrieved within a few seconds or minutes. In rare cases, this can take more than 15 minutes. A user policy is also updated only after the interactively signed-in account has been mapped correctly. Until then, the previous user’s policy may still apply.
For a user policy, therefore compare three identities:
- the locally signed-in account, for example
domain1\user1, - the mapping of this account to the correct Central user,
- the user that the MCS Client detected as interactively signed in.
Under Policy, Endpoint Self Help shows whether the individual components received their policy. On Windows, McsClient.log and McsAgent.log correlate communication and processing errors with time. Correctly evaluate Sophos Endpoint Windows logs and services lists the log paths.
Policy non-compliance is component-specific
A Policy non-compliance alert does not automatically mean that the entire Endpoint policy is missing. The alert identifies the component that has not reached its intended state. Investigate precisely that component in Endpoint Self Help, the local status and the corresponding component log. Only then restart the device and check again. If the alert returns, perform the component-specific repair instead of repeated restarts or a blanket reinstallation.
Depending on the notification configuration, administrators also receive the same event by email. Correlate multiple messages for the same device by time, policy type and component before treating them as separate incidents.
Base Policy and Sophos recommendations
Sophos supplies recommended defaults, particularly for Threat Protection. Account Health Check compares policy and device states with these recommendations.
Fix automatically can apply recommended values. Treat it like any bulk change: review affected policies, trace the change in the Audit Log and document critical exceptions first. A green score is useful, but not more important than a justified and compensated exception.
Time-limited exceptions
Every exception needs an owner, affected devices, technical reason, security impact, compensating control and expiry date.
Where possible, apply an exception in a targeted policy rather than globally. Configure Sophos Central Endpoint exclusions safely explains the difference for scanning exclusions.
Inspect the settings of a policy in bypass mode
In Policy bypass mode, Sophos Central hides the policy settings. This is expected. For inspection only, first make sure that no devices or users are assigned to the policy. Then enable Policy is Active without saving the change. The fields become visible while the stored bypass state remains unchanged.
Leave the page without saving. Do not temporarily activate an assigned bypass policy for this inspection, because accidental saving could enforce its settings again.
Common mistakes
The right policy exists but is not applied
Check order, target, active state and expiry date, then inspect the effective policy in the device record. A manual agent update cannot correct policy priority.
One setting appears to be ignored
Central chooses the entire policy. The setting may come from a different higher-priority policy than expected. Partner or Enterprise configuration can also lock options.
Users receive different rules on the same computer
This can be intentional with user policies. A computer policy is usually more predictable for shared or unattended systems.
A change creates many alerts
Stop the rollout, restore the pilot scope and identify the alert type and affected platform. Do not weaken the policy globally before the actual incompatibility is known.