Plan Sophos Central Endpoint roles and permissions
An Endpoint role must do more than display menus: it must permit precisely the intended operational and response actions.
Sophos Endpoint
Practical guidance for complete Sophos Central Endpoint operations: access, rollout, devices, policies, encryption, monitoring, XDR, Response and troubleshooting.
Contents
Central access and directories
2
Getting started and rollout
12
Devices, groups and software
3
Protection policies and baseline
9
Controls and exclusions
2
Device Encryption and recovery
4
Operations, updates and reporting
4
Monitoring, Health and notifications
1
Detection, XDR and Response
8
Troubleshooting and removal
3
Local agent and diagnostic tools
5
Sophos Endpoint topic overview
The articles follow the Endpoint lifecycle: secure Central, plan, install, group, protect, encrypt, monitor, respond and remove cleanly.
Central access and directories 2
Administrator access, MFA, API automation, identity sources and synchronisation with Active Directory and Entra ID.
Securely automate Sophos Central Endpoint API
The Endpoint API can manage devices, groups, policies, software and XDR data. The service principal, data region, permissions and error handling must …
Getting started and rollout 12
Initial setup, Agent Modes, requirements, Windows and macOS installation, piloting and tenant migration.
Deploy Sophos Central Endpoint systematically
A secure Endpoint rollout starts before the installer. Tenant, identities, licences, policy model, pilot group and operational processes must align.
Install Sophos Central Intercept X (Windows)
This guide explains current agent modes, a pilot rollout, and the clear boundary between full Sophos protection and XDR Sensor.
Plan Sophos Endpoint system requirements and lifecycle
Supported operating systems and agent versions change continuously. A lifecycle Runbook combines Sophos requirements, pilot groups, release notes and …
Sophos Endpoint Standard or Advanced: current mapping
Standard and Advanced are no longer current installer options. The licence, agent mode and software scope offered in the tenant determine what is …
Install Sophos Central Endpoint (macOS)
Install Sophos Central Endpoint on a single Mac or through MDM, grant the required macOS permissions, and resolve common installation issues.
Uninstall Sophos Central Endpoint on macOS
Remove Sophos Endpoint on macOS with the built-in Removal Tool or InstallationDeployer, not by deleting the app.
Automate Sophos Endpoint rollout on Windows
The Windows installer supports controlled bulk rollout with groups, Agent Mode, proxy, Message Relay and unambiguous installation logging.
Deploy Sophos Endpoint on macOS with MDM
A macOS bulk rollout needs current Sophos MDM profiles, System Extensions, Full Disk Access and repeatable validation in addition to the installer.
Sophos Endpoint macOS CLI and permissions
The macOS CLI enables reproducible installations. A Mac is fully protected only after System Extensions, Network Extensions and privacy permissions …
Prepare Sophos Endpoint in VDI gold images
Prepare a VDI gold image with the intended installer mode. Clones must come only from the master and need an appropriate lifecycle rule.
Safely test Sophos Endpoint protection features
A green Health State is not enough. Harmless Sophos and EICAR tests confirm the protection path, policy, user notification, event and cleanup.
Migrate Sophos Endpoint devices between Central tenants
A tenant migration changes management and policies. Check the target tenant, licence, installer, exclusions and rollback before the first device.
Devices, groups and software 3
Computer inventory, groups, policy assignment, installed components and inactive devices.
Manage Sophos Central Endpoint devices and groups
Learn how computers, groups, tags and software scope work together to create a reliable device inventory.
Map Sophos Central Endpoint users and groups correctly
Sophos Central distinguishes people, logins and devices. A clean identity source prevents duplicate users, incorrect licences and unexpected user …
Manage Sophos Endpoint agent mode and software
The current device view replaces the old feature dialogue. This guide explains software assignment, licensing, validation and safe switching.
Protection policies and baseline 9
Policy order, Threat Protection, Web, applications, peripherals, DLP, Windows Firewall and DNS Protection.
Build Sophos Central Endpoint policies correctly
The first matching policy wins. This guide creates a maintainable policy model and prevents priority mistakes.
Sophos Endpoint Threat Protection best practices
A practical Sophos Endpoint Threat Protection baseline with clear limits for exclusions and advanced settings.
Introduce Sophos Endpoint control policies safely
Four Endpoint controls solve different problems. This guide explains their effect, platform limits and safe rollout.
Configure Sophos Endpoint Application Control
Use Application Control as an inventory first. Block unwanted applications in a pilot group only after assessing the results.
Configure Sophos Endpoint Peripheral Control
Monitor peripherals first. A pilot policy then controls device types and accurately identified exceptions.
Configure Sophos Endpoint Web Control
The current Windows web policy uses reusable Web Filtering Profiles. Classic remains relevant for older agents and other platforms.
Configure Sophos Endpoint Data Loss Prevention
Endpoint DLP combines reusable rules with a policy. Log content and files first, then require confirmation or block precisely.
Manage Windows Firewall with Sophos Central Endpoint
The Endpoint policy monitors or controls Windows Firewall profiles. It neither replaces Sophos Firewall nor creates a central detailed rule base.
Configure Sophos DNS Protection for endpoints
The Endpoint policy redirects DNS requests securely to Sophos. Internal namespaces and platform limits require careful planning.
Controls and exclusions 2
Tamper Protection, global and policy exclusions, authorisations, risks and controlled validation.
Disable Sophos Central Tamper Protection safely
Tamper Protection should be disabled only for a defined maintenance window. This guide explains the current methods and safe rollback.
Configure Sophos Central Endpoint exclusions safely
Exclusions can greatly reduce protection and visibility. This guide covers selection, approval, testing and regular cleanup.
Device Encryption and recovery 4
BitLocker and FileVault policies, authentication, recovery keys, Self Service, migration and decryption.
Deploy Sophos Central Device Encryption securely
Sophos does not replace operating-system drive encryption. It centrally manages BitLocker and FileVault policies, status and recovery keys.
Manage BitLocker with Sophos Central
Sophos Central orchestrates BitLocker. TPM, authentication mode, Windows GPOs, partitioning and recovery keys remain essential to a stable rollout.
Manage FileVault with Sophos Central
FileVault depends on more than policy. User authorisation, Secure Token, Bootstrap Token, MDM and a valid personal recovery key must align.
Systematically troubleshoot Sophos Device Encryption
Troubleshoot Device Encryption using the local operating system status, CDE.log and the specific error code instead of repeatedly changing the policy.
Operations, updates and reporting 4
Licences, Software Packages, Update Caches, proxies, status, Events, Reports, maintenance and lifecycle.
Sophos Endpoint updates, cache and Message Relay
Update Management controls product versions, not threat intelligence. Cache and Relay save bandwidth and carry Central communication.
Sophos Endpoint network and proxy requirements
Endpoints need DNS and HTTPS to Sophos. Plan proxy, Message Relay and Update Cache as a clear, tested communication path.
Analysing Sophos Endpoint events, alerts and reports
Events remain as history, while alerts require attention. Audit Log, DLP Log and Endpoint Reports have their own time periods and limitations.
Understanding Sophos Central Endpoint licences
Endpoint licences are usually calculated per user. Offline devices, duplicate users and licence expiry behave differently from what the device list …
Monitoring, Health and notifications 1
Alert emails, Account Health, device state, Event analysis and operational escalation.
Handle Sophos Endpoint alerts and Account Health
Alerts and Account Health indicate where action is required. Close, Resolve, Reset, Snooze and Auto-Fix do not replace investigation of the technical …
Detection, XDR and Response 8
Threat Cleanup, XDR Cases, AI Assistant, IP blocking, Device Isolation, Live Response, Forensic Snapshots and Security Heartbeat.
Sophos Endpoint Threat Cleanup and malware removal
The correct response depends on the Detection type. Check isolation, the process chain, Cleanup status, persistence and root cause before closing.
Isolate Sophos Endpoint and use Live Response
Admin isolation and automatic isolation behave differently. This guide covers investigation, remediation and safe reconnection.
Sophos Endpoint Data Collection and Live Discover
Live Endpoint queries connected devices, while Data Lake provides historical telemetry. Policy, retention and query guardrails determine reach and …
Operate Sophos XDR Cases and Detection Rules
Cases group investigations and Detection Rules generate signals. Both require ownership, traceable Suppression and clear closure criteria.
Investigating Sophos Endpoint detections and Threat Graphs
Events report known actions, while detections identify suspicious activity that was not blocked. Threat Lineage and Threat Graphs provide …
Use Sophos AI Assistant and AI Search in XDR
AI accelerates search and summarisation, but does not replace evidence review or incident decisions. Prompts and results remain controlled working …
Block compromised IP addresses with Sophos Endpoint
Central distributes IP blocks to Windows and Linux Endpoints. Document scope, expiry, exclusions and Response before a tenant-wide block.
Sophos Security Heartbeat and Synchronized Security
Endpoint and Firewall remain separate products. Heartbeat reports state; Synchronized Security applies the configured network response.
Troubleshooting and removal 3
Diagnostics, repair, Tamper Protection special cases, controlled removal and device cleanup.
Troubleshoot Sophos Endpoint installation systematically
A reproducible installation Runbook separates download, bootstrap, component installation, registration and policy sync, avoiding blind …
Uninstall Sophos Central Endpoint on Windows
The current procedure uses SophosUninstall.exe, separates local removal from Central deletion and verifies the result.
Uninstall Sophos Endpoint with Tamper Protection enabled
Remove Sophos Endpoint despite Tamper Protection using supported recovery, password retrieval and re-registration instead of registry hacks.
Local agent and diagnostic tools 5
Local Endpoint interface, scans, Windows logs and services, Self Help, SDU, CLI diagnostics, macOS permissions and support data.
Use Sophos Endpoint locally and check protection status
The local Endpoint interface shows whether protection modules work, which Events occurred and which actions an administrator can perform on the …
Plan and troubleshoot Sophos Endpoint scans
Real-time protection and scheduled scans complement each other. This article covers selection, scheduling, performance limits, logs, and typical File …
Scan Sophos Endpoint on Windows from the CLI
The Intercept X CLI runs targeted or full Windows scans and provides actionable exit codes and JSON for RMM and Incident Response Runbooks.
Diagnose Sophos Endpoint with Self Help and SDU
Self Help identifies common agent problems. SDU collects the technical logs required for a sound analysis or a complete Sophos support ticket.
Correctly evaluate Sophos Endpoint Windows logs and services
Not every Sophos log is relevant to every error. This reference maps a visible symptom to the right Windows log, service and next diagnostic step.