How is Sophos Fusion licensed?
Sophos Fusion (formerly Sophos Central) is a shared management platform, not one license product. Endpoint, XDR, MDR, Server, Device Encryption, Email, Firewall, Wireless, and other services have their own usage and expiration rules.
The key consequence is that a number on the Central Licensing page must always be assessed together with the product name and license contract. Portal-calculated usage supports control but replaces neither the License Schedule nor EULA.
Main counting models
| Product type | Typical counting basis | Important detail |
|---|---|---|
| Endpoint, XDR, and MDR for endpoints | Usually user | Usage is calculated separately by license type from active users and devices |
| Device Encryption | User or actively protected device according to contract | Under Flex, installation alone may not trigger usage; the Encryption policy is decisive |
| Server Protection | Protected server | RDS sessions are covered through Server Protection, not as normal Endpoint users |
| Sophos Email | Protected users and shared mailboxes | Aliases, distribution lists, and public folders generally need no separate license |
| Firewall | Appliance, virtual instance, and subscriptions | Base License, Support, and Security subscriptions have separate effects |
| Wireless, Switch, and Access Points | Device or support service | Model and term depend on hardware generation and service |
Products, bundles, and names change. For an order, always use the current License Schedule for the specific customer, not an old product list from an article or quote.
Product models that are often misunderstood
Some Central products count neither like Endpoint nor like traditional hardware. The following classification helps with monthly reviews and renewals:
| Product | What counts | Operational detail |
|---|---|---|
| Sophos Email | Individual users and shared mailboxes for which at least one message was processed in the last 30 days | Aliases, distribution lists, and public folders do not count; the display updates about every four hours |
| Sophos Mobile | Assigned users or devices without a user | Several devices for one user count once; only devices synchronized within the last 30 days are considered |
| Sophos Phish Threat | Unique recipients of a simulation or training campaign | Daily calculation considers recipients from the last 30 days; deleting or ending a campaign does not remove usage retroactively |
| Sophos AP6 | Support and Services per AP6 managed through Central | Without a valid and sufficient subscription, local management remains possible but Central cannot change the AP |
| Sophos Switch | Support and Services per deployed switch | Sophos Fusion management, firmware updates, 24/7 multichannel support, and Advanced RMA require a suitable subscription for each device |
| Workspace Protection | Highest consumption among included products | The largest count among Protected Browser users, ZTNA users, DNS Protection devices, and Email Monitoring mailboxes determines bundle quantity |
Workspace Protection: bundle and required quantity
Workspace Protection is available as a standalone term license or through MSP Flex. The bundle includes:
- Sophos Protected Browser,
- Sophos ZTNA,
- Sophos DNS Protection for endpoints,
- Sophos Email Monitoring System.
The standalone Workspace Protection license includes no full Sophos Endpoint. To obtain Endpoint in the same bundle, you must explicitly purchase Sophos Endpoint Plus Workspace Protection. For the technical setup of Sophos DNS Protection for endpoints, see the separate guide Set up Sophos DNS Protection for endpoints.
The required bundle quantity is not the sum of all four products, but the highest measured consumption:
- Protected Browser: unique authenticated users within 30 days,
- ZTNA: unique authenticated users within 30 days,
- DNS Protection for endpoints: devices that use DNS Protection,
- Email Monitoring System: mailboxes.
For example, 75 ZTNA users, 80 Protected Browser users, and 100 devices with DNS Protection require a quantity of 100, not 255. With the combined bundle, the number of Sophos Endpoint devices enters the same comparison. If there are also 120 Endpoint devices, 120 is the applicable quantity.
For user-based components, the same authenticated person counts once even when signing in on several devices. The same ZTNA license applies to both on-premises and Sophos Cloud Gateways and to agent-based and agentless access. Sophos Cloud Gateways additionally carry an average bandwidth entitlement of 15 GB per user per month; account for it separately in capacity planning.
Activation and management take place in Sophos Fusion under Profile icon > Licensing. Verify that Standalone Workspace Protection or Sophos Endpoint Plus Workspace Protection is active for the expected term. Then compare Protected Browser users, ZTNA authenticated users, DNS Protection devices, and Email Monitoring mailboxes, plus Sophos Endpoint devices for the combined bundle. The check succeeds when the highest displayed value does not exceed the ordered quantity. If the expected license is missing, the wrong variant is active, or the quantity is insufficient, next compare the displayed license name and Expires date with the License Schedule and its ordered quantity; the consumption display with the highest value identifies which component needs additional capacity. Resolve a differing activation or order quantity with the Sophos Partner. A 30-day trial is available for Workspace Protection.
After expiration, the Workspace Protection products are no longer available in Sophos Fusion. The configuration is retained and reappears after renewal. Therefore, do not treat expiration as an instruction to delete or rebuild: first check the license name, Expires date, and renewal.
Xstream Protection for a Sophos Firewall covers only standalone DNS Protection and does not grant DNS Protection for endpoints. Sophos Firewall bundles and licenses provides details about the firewall bundles; Sophos DNS Protection explains the standalone DNS Protection service.
Standalone DNS Protection from Xstream Protection requires at least one currently licensed firewall in the tenant. If the final suitable license expires or every licensed firewall moves to another Central tenant, DNS Protection ends in the original tenant. When an MSP removes the final Flex firewall, access can end within one day. Air Gap licensing does not support DNS Protection because the service requires a firewall activated or managed in Central. With a mix of trial and purchased licenses, the service remains available while at least one is valid.
Sophos Switch: local management or Sophos Fusion?
For a Sophos Switch, consider the hardware, local management, and additional service separately. The hardware purchase includes local management through the web interface and CLI. If no switch is managed with Sophos Fusion, no Sophos Switch Support and Services subscription is required for this. Choose Sophos Switch models and management explains the choice between local and centralized operation and the available management methods.
As soon as switches are managed with Sophos Fusion, every deployed switch needs a suitable Support and Services subscription in the Sophos Fusion account. It includes:
- all Sophos Fusion management features for switches, including managing ports and VLANs, configuring the device, and viewing its status,
- firmware updates,
- 24/7 multichannel support,
- Advanced RMA.
Without a valid subscription, the switch continues to forward network traffic and remains locally manageable. Changes through Sophos Fusion are not possible, however. Free self-service resources remain available, while personal Sophos support by phone, chat, or support case requires a valid support license. Keep this license boundary separate from registration and technical reachability: a switch can be registered or work locally without its Fusion management being validly licensed.
Activate and manage the license in Sophos Fusion under Profile icon > Licensing. If the subscription covers fewer devices than are actually deployed, an Oversubscription warning appears. The additional switches continue to work, but another subscription must be purchased for them. The same applies after expiration: operation does not stop automatically, but support and licensed benefits are not covered again until a new valid subscription is in place.
For acceptance, therefore, check three points separately: the switch is locally reachable, the subscription quantity under Profile icon > Licensing is sufficient for all deployed switches, and a small reversible change from Sophos Fusion is applied successfully. Register Sophos Switch in Sophos Fusion describes the complete registration and status-check procedure.
AP6 has a similar separation between local operation and the Central service. APX Access Points, however, do not need an AP6 Support and Services license; APX and AP6 are separate generations for licensing.
Sophos Email after expiration
Sophos Email and Sophos Email Plus are different feature levels. Portal Encryption is an add-on whose quantity cannot exceed purchased Sophos Email quantity. It is assigned through a Secure Message policy and is required for custom encryption-portal branding. An existing Email customer can trial Portal Encryption but cannot trial the base service and add-on simultaneously.
DMARC Manager is available as an add-on for Sophos Email and Sophos Email Monitoring System and is included in Sophos Email Plus. MSP customers can also purchase Sophos Email as a Monthly Flex SKU; business counting rules stay the same.
License Usage Summary combines Sophos Email and Phish Threat usage into one unique total and does not show the products separately. For root-cause analysis, also review mailbox inventory, processed messages, and Phish Threat recipients.
Exceeding purchased Email quantity does not stop protection immediately. Central flags the account, creates an Alert, and identifies uncovered mailboxes in License Usage Summary; all mailboxes initially remain protected. Then reduce quantity or expand licensing.
Actual license expiration is more critical. Sophos may temporarily provide up to 30 additional protection days, but this is not a guaranteed grace period. In Gateway Mode, move MX records away from Sophos after final expiration or messages are rejected. In Mailflow Mode, Sophos begins automatic Microsoft 365 cleanup; still inspect connectors and mail-flow rules manually afterward. A renewal during any granted transition starts retroactively at the previous license end.
Sophos Mobile and Phish Threat
For Mobile, each user assigned to a managed device consumes one license regardless of device count. A device without a user counts as one license itself. Usage display can be inaccurate and excess is therefore not immediately enforced technically; contractual need remains authoritative. Independently, Android Enterprise technically limits simultaneous enrollment to ten devices per user.
Phish Threat counts a recipient once a campaign or training-only email is sent. The same user needs only one license during the term despite many emails. After expiration, no new campaigns or reminders are sent, while data from already sent campaigns continues to be collected. Under MSP Flex, monthly billing follows recipients of campaigns sent during the billing period.
User-based does not mean manual assignment
For Endpoint, a license is not assigned through a checkbox like a Microsoft 365 plan. Sophos Fusion detects active users on protected devices and maps devices to those identities.
One user can use several devices. Each device is assigned to only one user for calculation. If the same person signs in to two devices with different local accounts, Central can identify two users and count twice. Map the logins to an existing user after business verification.
License types are also counted independently. A user with Endpoint on device A and XDR on device B can create one Endpoint and one XDR usage. Device Encryption follows its own function and policy state.
Inactive devices and calculation delay
For Endpoint, devices disconnected for more than 30 days temporarily stop counting toward license usage. When a device returns, it counts again and updates its components.
This is a calculation rule, not a lifecycle strategy. Remove obsolete, lost, or retired devices through documented offboarding so inventory, Alerts, and ownership remain clear.
The portal count can react with delay. An immediate discrepancy after installation, deletion, or user assignment therefore does not prove an error.
Contractual usage takes precedence
Sophos explicitly states that in-product calculation can differ from actual licensing duty under the EULA. If Central underestimates consumption, real usage remains authoritative. A displayed technical count is not permission to underlicense.
Conversely, functions are not always blocked immediately when Central reports excess. Investigate and reconcile the deviation with the Sophos Partner before it becomes a renewal or compliance problem.
Initial purchase, upgrade, and renewal
An initial purchase activates a new product in a tenant. An upgrade expands or replaces functions during an active term. A renewal extends existing usage rights.
This distinction matters technically. A purchased license is activated under Profile icon > Licensing with the key from the License Schedule unless the Sophos Partner handles activation. Depending on the view, the action is called Apply Activation Code or Apply License Key. An upgrade can install new agent components or expose policies. Sophos may update affected devices immediately after a license or software change even if scheduled updates are configured. Treat activation as a technical change, not merely a commercial step.
A renewal should primarily extend the term, but a changed edition can also alter functions. From 30 days before expiry, Central shows every administrator with account access a recurring sign-in reminder. If all licenses eventually expire, access can be restricted to Licensing, and the tenant may later be deleted. Review product-specific expiry behavior before the end date because an expired entitlement does not have the same technical effect for every product.
Renewal before expiry is handled by the Sophos Partner or assigned Sophos Renewals contact. For licenses that have already expired, reinstatement of the license and protection is initiated with the Sophos Sales representative or partner. If the responsible partner or Account Owner is unknown, Customer and Partner Care helps identify the renewal contact.
Customer types such as Commercial, Education, and Government can have different purchasing terms. Verify eligibility with the Sophos Partner rather than assuming it from the organization’s name.
Clarify trials and data region before purchase
A Central trial normally lasts 30 days and initially needs no activation key. Under Profile icon > Licensing, its number starts with C rather than L, while Expires shows the end date. Multiple product trials can run in parallel from different start dates as long as their features do not overlap. A trial tenant is limited to 1,000 entries per object type, such as users, groups, shared mailboxes, public folders, or devices. This directory limit is removed after conversion to a paid license.
A product that already has a paid license is not offered as a trial again. After a trial expires, you must wait 30 days before starting another trial of the same product yourself; ask the Sophos Partner or Account Manager about an extension. The purchase decision, test end, and rollback therefore belong in the pilot plan before starting.
The data region is also a licensing decision. Check availability separately for each planned product; restrictions affecting Sophos Mobile or APX access points must not be applied to ITDR as a blanket rule. On August 10, 2026, Sophos added ITDR support for Canada, Australia, Japan, India and Brazil. The ITDR region check explains the supported region groups and limitations. If another planned product is unavailable in the existing tenant region, clarify licensing, any cancellation and a suitable new tenant with the Sophos Partner before purchase; a missing menu item alone is not a reason to create a new tenant.
Monthly license review
A reliable review compares:
- license product, edition, and term on the Licensing page,
- actual users, devices, servers, or mailboxes,
- installed and enabled product components,
- inactive, duplicate, or incorrectly assigned objects,
- ordered quantity and contractual counting basis,
- upcoming changes from growth, projects, or M&A.
Technical activation, usage review, and renewal are covered in Activate, review, and renew Sophos Fusion licenses.