Commission a Sophos Central tenant securely
A Central tenant is ready only when access, roles, directory, licenses, monitoring, audit, and recovery are defined. Installing one product is not …
Sophos Central Admin
Practical guides for secure Sophos Central operations: configure the tenant, secure access, synchronize directories, control licenses, monitor changes, and operate automations safely.
Contents
Sophos Central Admin topic overview
The articles follow the administrative lifecycle of a Central tenant: access and roles, directory and user maintenance, licensing, monitoring, automation, platform operations, and Enterprise structures. Product-specific Endpoint, Firewall, Email, or MDR configuration remains in the relevant specialist category.
Getting started and navigation 1
SophosID, Central tenant, portals, navigation, and a controlled start in cloud management.
Access, MFA, and roles 5
Administrator access, passkeys, federated sign-in, roles, Custom Roles, and least privilege.
Secure Sophos Central sign-in with MFA and passkeys
Secure Central access requires more than a strong password: redundant MFA, minimal roles, a tested recovery process and clear IdP rules.
Configure Microsoft Entra ID as a Sophos Central IdP
For Sophos Central SSO with Entra ID, verify the domain, tenant ID, email mapping, and MFA first. A differing UPN requires a dedicated OIDC app with …
Configure OpenID Connect and Okta for Sophos Central SSO
Sophos Central uses SP-initiated OIDC with an ID token. Fully test the provider, callback, claims, domain, and MFA before selecting Federated …
Connect Microsoft AD FS to Sophos Central
AD FS requires a verified domain, matching email identities, and a claims-aware Relying Party Trust using the values supplied by Central.
Assign Sophos Central administration roles correctly
Central roles follow least privilege. Reserve Super Admin for roles and API Credentials, and use Custom Roles to restrict products and especially …
Directories and users 6
User lifecycle and synchronization with Active Directory, Microsoft Entra ID, or Google Workspace.
Synchronise Active Directory with Sophos Central
AD Sync is not a blind import. The source directory, OU filters, deletion behaviour, service account, schedule and error handling must be defined …
Synchronize Microsoft Entra ID with Sophos Central
Sophos Central imports users and groups from Microsoft Entra ID. This guide covers app registration, permissions, filters, the first sync, and secret …
Synchronize Google Workspace with Sophos Central
Google Directory Sync imports mailboxes, groups, and distribution lists for Sophos Email or Phish Threat. Plan filters, OAuth permissions, and any …
Manage Sophos Central users and groups
Users can originate manually, by CSV, from protected devices, or a directory. Clear source ownership prevents duplicates, incorrect roles, and …
Rename Sophos Central users and correct master data
Manual users are changed in Central; synchronized users in the authoritative directory. A new display name does not resolve wrong logins or duplicate …
Delete and offboard Sophos Central users safely
Deleting a Central user removes neither devices nor Endpoint software. Directory Sync or a device still in use can recreate the user automatically.
Licenses and subscriptions 3
License models, activation, usage, trials, renewals, and the technical effects of expiration.
How is Sophos Central licensed?
Sophos Central has no single counting model. Endpoint is generally licensed per user, Server per protected server, and Email per protected mailbox; …
Activate, review, and renew Sophos Central licenses
The Licensing page shows entitlements, terms, and usage. Activation and renewal can change software components, while expired licenses restrict …
Merge Sophos Central logins and correct license usage
Central does not assign Endpoint licenses manually. Multiple logins for the same person can create duplicate users and should be mapped to one …
Monitoring, dashboards, and audit 5
Alerts, Account Health, dashboards, reports, Audit Logs, export, retention, and operational escalation.
Analyze and retain Sophos Central Audit Logs
Audit Logs show who made a Central change, when, and from which IP address. The portal retains at most 90 days, so operations need recurring exports …
Use Sophos Central Account Health Check correctly
Account Health assesses recommended settings and device states. A score below 100 requires review, while a green score does not prove complete …
Configure Sophos Central dashboards for operations
Central dashboards are personal working views, not shared operating documentation. A useful dashboard shows alerts, health, protection status, and …
Configure Sophos Central alert email notifications
Alert emails become an operational process only when recipients, severities, cover, escalation and regular tests are defined.
Schedule, export, and monitor Sophos Central reports
A scheduled Central report needs a business owner, appropriate recipients, and expiration monitoring. Legacy reports in particular stop after six …
APIs and integrations 2
API credentials, technical identities, third-party access, secret rotation, and secure automation.
Manage Sophos Central API credentials securely
API credentials are independent machine identities. A minimal service principal role, secure secret transfer, expiration monitoring, and traceable …
Operate Sophos Central Integration Credential Manager
Integration Credential Manager stores third-party credentials used by Sophos integrations. Operate health, usage, inactivity, and rotation separately …
Platform operations 3
Global platform functions, privacy, data sharing, Early Access Programs, and controlled changes.
Use Sophos Central Global Settings and policies correctly
Global Settings apply tenant-wide or provide shared objects. Policies control selected users and devices. Scope, priority, and rollback must be clear …
Control Sophos Central privacy and data sharing
Cloud analysis improves detection and support but may transfer files, URLs, emails, logs, or telemetry. Every tenant-wide sharing option needs a …
Test Sophos Central Early Access Programs safely
EAP functions are prerelease versions and belong on a few non-critical pilot devices. Entry, device scope, monitoring, and rollback must be defined …
Central Enterprise 3
Enterprise Management, sub-estates, Enterprise administrators, and master licensing.
Understand Sophos Central Enterprise and sub-estates
Central Enterprise manages several separate Central tenants as sub-estates. It does not replace product configuration and requires clear access, …
Enable Sophos Central Enterprise Management
Enterprise Management is a far-reaching structural change. Trial tenants are excluded, existing administrators can lose tenant access, and only …
Plan and enable Sophos Central Enterprise Master Licensing
Master Licensing creates a shared license pool for sub-estates. Conversion is irreversible, moves license management to Enterprise, and can remove …
Portals and support 4
SophosID, Support Portal, Partner Assistance, Remote Assistance, and secure preparation of a support case.
Sophos portals: Central, Self Service, Support and firewall
Central Admin, Self Service, Support, and firewall portals serve different purposes. Sign-in, licensing, access, and Remote Access are key …
Configure Sophos Central Self Service Portal access
Automatic self-service access applies to new and existing users, but turning it off later does not revoke existing access. Licenses, email addresses, …
Open a Sophos support ticket with Support Assistant
Since July 2026, Sophos Support Assistant guides troubleshooting and case creation. Good preparation remains essential for an efficient support case.
Secure Sophos Central Partner and Remote Assistance
Partners, Sophos Support, and Enterprise administrators use different access paths. Every access needs a purpose, owner, suitable duration, and a …