Install Sophos Connect Client on macOS

Sophos Connect 2.1 for macOS supports IPsec and SSL VPN on Intel Macs and Apple Silicon from macOS 14. This version runs natively on Apple Silicon. Download the installer from the organisation’s VPN Portal under VPN > Download for macOS; IT provides the portal address and the appropriate connection profile.

After installation, import a .scx for IPsec or an .ovpn for SSL VPN. From 2.1, IT can instead provide a .pro to retrieve profiles automatically. This article covers downloading, installation, profile import and the checks that follow. For the fundamental choice between Sophos Connect, SSL VPN, OpenVPN clients and ZTNA, see Sophos Connect or SSL VPN: Which Remote Access Solution Fits?.

Which Article Is Right for You?

Sophos Connect on macOS quickly overlaps with other remote access articles. Depending on the task, another starting point may be more suitable:

• Install Sophos Connect on macOS: This article.
• Set up SSL VPN on macOS with .ovpn: Set up Sophos SSL VPN with Sophos Connect on macOS.
• Prepare Sophos Connect on the firewall: Configure Sophos Connect on Sophos Firewall.
• Plan client versions, updates and profile maintenance: Check and Securely Update Sophos Connect Client Version.
• Diagnose import, sign-in or connection errors: Troubleshoot Sophos Connect Client.
• VPN is connected, but traffic does not work: Test Firewall Rule with Log Viewer, Policy Test and Packet Capture.

This distinction matters because installing the client is only one part of operating remote access. Firewall rules, DNS, MFA, certificates, the VPN Portal and profile distribution remain separate checkpoints.

Prerequisites

• Sophos Firewall with a configured remote access connection
• Sophos Connect Client in a version compatible with the firewall and platform
• Intel Mac or Apple Silicon with a macOS version compatible with the client version; see the overview below
• Configuration file for IPsec (.scx) or SSL VPN (.ovpn), alternatively a .pro supplied by IT from client 2.1
• No old Sophos SSL VPN Client installed in parallel
• User account with VPN permission and working MFA if enabled
• Firewall rules for traffic from the VPN zone or the remote access zone in use

Which version is right for the Mac?

As of 21 October 2026, the Sophos release notes list Sophos Connect 2.1 for macOS, released on 6 October 2026, as the current Mac release. The higher Windows version number 2.5 MR1 is not a macOS package version.

• 2.1 from macOS 14 Sonoma: Intel and Apple Silicon; Apple Silicon runs natively on ARM. IPsec and SSL VPN, .pro provisioning and Microsoft Entra ID SSO are supported. SSO sign-in in the system browser additionally requires SFOS 22.0 MR3 or later.
• 2.0 line from macOS 13 Ventura: IPsec and SSL VPN with manual profile import; Apple Silicon through Rosetta 2. The latest listed maintenance release is 2.0 MR1, released on 21 May 2026. Native ARM execution, .pro provisioning and Entra ID SSO are not available in this line.
• Before 2.0: The macOS client supports only IPsec. These old packages are unsuitable for SSL VPN.

Check the version of the macOS package actually supplied before installation. A release announcement proves neither that the organisation’s firewall already delivers this package nor that the combination of client, macOS and VPN profile is approved for use in the organisation. Safely update Sophos Connect explains version checks and a controlled rollback.

Apple Silicon and macOS upgrades

Rosetta is not a blanket prerequisite for the native 2.1 client. However, it remains a dependency for a 2.0 client still in use: Rosetta’s general availability does not establish that the specific installer or VPN operation is approved for macOS 27. Approval for Sophos Endpoint is likewise not evidence for Sophos Connect.

Before a macOS upgrade, check installation, the IPsec or SSL VPN profile actually used, MFA, internal DNS resolution and reconnection on a pilot device. Defer the upgrade of VPN-dependent devices until this test passes. Do not plan to run the Intel client from the 2.0 line on macOS 28; approve a native or another supported VPN option in good time instead. This guide does not report a device test having been carried out.

1. Download Sophos Connect Client

On SFOS 22, an administrator downloads the Sophos Connect Client for macOS in WebAdmin from Remote access VPN > IPsec > Download client or Remote access VPN > SSL VPN > Download client. Users instead open the VPN Portal, at https://<firewall-FQDN>:443 by default, and select VPN > Download for macOS. The current client is available in the VPN Portal; the WebAdmin package is current when pattern updates are set to update automatically under Backup & Firmware > Pattern updates.

The existing Sophos Download Page is the UTM download page. For an SFOS installation, use WebAdmin or the VPN Portal as the package source. Managed environments must also define the approved client version and where users obtain the correct configuration file.

The file depends on the connection configured on the firewall:

• IPsec: Import .scx directly.
• SSL VPN: Import the personal .ovpn directly; Sophos Connect 2.0 or later is required.
• Automatic profile retrieval from macOS client 2.1: IT supplies a .pro. It retrieves the authorised IPsec and SSL VPN profiles through the VPN Portal and fetches later changes; it is not itself a tunnel profile. macOS client 2.0 still requires direct imports and manual updates. Sophos Connect provisioning with .pro explains the workflow.

On SFOS 22, obtain the profiles from these locations:

1. IPsec: Open Remote access VPN > IPsec > Export connection. The archive contains .scx and .tgb; distribute the .scx file that Sophos recommends for Sophos Connect.
2. SSL VPN: In the VPN Portal, open VPN > VPN configuration > SSL VPN configuration and choose Download configuration for Windows, macOS, Linux. For Sophos Connect, use Use with Sophos Connect and OpenVPN Connect v2 clients; Use with OpenVPN Connect v3 clients is for OpenVPN Connect 3, not Sophos Connect. Download the .ovpn file. This download is absent if the user has no matching SSL VPN policy.
3. Store the file securely and provide it only to the intended user.

The current package name follows the pattern SophosConnect_x.x_(IPsec_and_SSLVPN).pkg. A package with (IPsec) in its name belongs to the older macOS line and does not include SSL VPN support.

Do not distribute the installer widely across managed Macs without using a pilot group. If the organisation has both platforms, test at least one Intel Mac and one Apple Silicon Mac first.

2. Install Sophos Connect Client

Before installation, remove any existing old Sophos SSL VPN Client. The installation guide rules out running Sophos Connect alongside another VPN client, while the general troubleshooting guidance still describes a different installation order for the old SSL VPN Client. This does not constitute general approval for parallel clients; if a legacy exception is necessary, clarify the specific combination with Sophos. The current upgrade guide specifies downloading and installing the new package, but does not impose a general requirement to uninstall first. Use the remove-and-reinstall process described here only as a controlled maintenance or rollback procedure approved for the target version, not as a mandatory prerequisite for every update.

Double-click SophosConnect_x.x_(IPsec_and_SSLVPN).pkg to start the installation; x.x represents the approved version. Check the destination and available disk space, click Install and complete the wizard with Finish.

On Apple Silicon, Sophos Connect 2.0 requires Rosetta 2; from 2.1, ARM is supported natively. Rosetta is therefore not a blanket prerequisite for 2.1. If macOS prompts for it when using the approved 2.0 installer, install Rosetta 2 and restart the client. On macOS 27, do not assume that Rosetta installed before the upgrade will be restored automatically or that a particular installation package will work unchanged. For both client branches, test installation and the VPN connection in a pilot.

Check the version directly in the client after installation. This is particularly important if several installation packages have circulated internally or users have installed the client before.

3. Download the Connection File

When Sophos Connect starts for the first time, it requires a connection configuration. This file should come from the current firewall configuration and should not be reused from an old user archive.

Typical connection files are:

• IPsec Remote Access: .scx; export it from the current Remote Access IPsec configuration.
• SSL VPN: .ovpn; obtain it from the VPN Portal or an administrative export.
• Provisioning from 2.1: .pro; a retrieval method supplied by IT for the authorised profiles.

If old Remote Access IPsec configurations are still in use before an SFOS 22 MR1 upgrade, do not simply redistribute an old profile. First see Migrate Legacy Remote Access IPsec before SFOS 22 MR1.

Treat profiles like credentials. An old .ovpn or .scx file may still contain internal networks, gateway names, certificates or user references. If the gateway, certificate, DNS, user group, IP pool or authentication has changed, export and import the profile again.

For SSL VPN, the .ovpn file is user-specific: it contains a unique user certificate and private key, so it must not be distributed as a shared team profile. A raw .pro file instead contains provisioning metadata and is not inherently user-specific; it is not the same as the SSL VPN profile and certificates generated during import. Do not share those generated profiles or private keys between users either.

For SFOS 22, Sophos documents that an imported SSL VPN profile is bound to the user identity, domain and authentication method. When changing, for example, from local authentication to Active Directory, obtain and import a separate .ovpn configuration or use a separate .pro import to generate the appropriate SSL profile. According to that SFOS 22 documentation, reusing the imported profile with a different method or domain can trigger Login failed. Wrong fingerprint of certificate. This documented SSL binding does not apply to .scx IPsec profiles.

For SFOS 23, runtime behaviour remains unresolved: the corresponding section is absent from the Sophos guide compared here. That establishes neither relaxed reuse nor a confirmed unchanged binding. Until version-specific confirmation is available, continue to obtain and import separate SSL profiles for the intended identity, method and domain. This is a precaution, not a verified SFOS 23 runtime rule; do not bypass certificate validation.

When migrating from a third-party client, you can import existing compatible configuration files into Sophos Connect. For IPsec, first configure the advanced settings on the firewall and distribute a current .scx or, from macOS client 2.1, a suitable .pro: this also delivers settings that third-party clients do not support. A client version update alone does not automatically invalidate existing configuration files; firewall changes must be handled separately.

4. Set Up Sophos Connect Client

Sophos Connect can be set up in a few steps:

1. Open Sophos Connect.
2. Select Import connection.
3. Import the appropriate connection file.
4. Check the connection under Connections.
5. Click Connect.
6. Sign in with the VPN user and confirm MFA if enabled.

After the connection has been established, also check whether internal DNS names resolve and the required systems are reachable. If the connection is up but no traffic flows, use Log Viewer, Policy Test and Packet Capture. See Test Firewall Rule with Log Viewer, Policy Test and Packet Capture.

The DNS test is particularly important for SSL VPN on macOS. Sophos Connect 2.0 MR1 fixes an issue that prevented DNS settings for SSL VPN connections from being applied correctly on macOS. If internal names do not resolve, check the version and profile status before changing DNS rules without evidence.

For SSL VPN with multiple gateways in the .ovpn file, Sophos Connect tries the entries in reverse priority order; Dynamic DNS gateways take precedence over WAN IP gateways. If an attempt fails, it tries the next available gateway in that order. If the selected gateway is unexpected, compare the current file with the destinations actually attempted in the client events rather than assuming that the first list entry is preferred.

Microsoft Entra ID SSO on macOS (Sophos Connect 2.1): browser and return to the client

Entra ID SSO is documented for IPsec, SSL VPN and provisioning from Sophos Connect 2.1 for macOS; macOS 2.0 does not support this client workflow. Before starting, check the appropriate Entra ID configuration on the firewall, authentication methods and Redirect URI. On macOS 14+, use the approved 2.1 package version. Browser selection depends on the connection or provisioning configuration, not solely on the operating system. System-browser authentication and automatic fallback to it require SFOS 22.0 MR3 or later. Before using this workflow, clarify the firewall version with IT; an older version does not meet this requirement.

Before using Entra ID SSO, verify that the VPN Portal, SSL VPN policy and Microsoft Entra ID configuration use the required authentication server.

1. Select the correct connection in Sophos Connect, use SSO sign-in and start Connect. Complete sign-in in the browser opened by Sophos Connect, including the required MFA or compliance check. Signing in to the portal in an independently opened browser does not replace this client workflow.
2. If sso_auth_browser_type is missing or set to auto, Sophos Connect starts in the embedded browser. If sign-in cannot be completed there because of Conditional Access requirements, the client automatically switches to the default system browser and tries signing in again. Complete sign-in there and then return to Sophos Connect.
3. With embedded, only the embedded browser is used: no automatic fallback. If sign-in fails because of Conditional Access, ask IT to provide an approved provisioning file with system and try again. With system, only the system browser is used; return to Sophos Connect after signing in.
4. Directly imported .ovpn or .scx profiles behave like auto: embedded first, then automatically using the system browser where the relevant Conditional Access requirements apply. If the required browser switch does not occur and the error persists, ask IT to provide an approved .pro file with sso_auth_browser_type set to system. The provisioning schema and permitted values belong in Sophos Connect Provisioning; do not invent manual changes to .ovpn or .scx as browser configuration.

A compliance error is not an instruction to weaken security rules. Complete the required compliance measures or contact IT. Do not disable Conditional Access, MFA or certificate validation to force sign-in. Only after returning to the client should you check the tunnel status, VPN IP, DNS and access. The Windows workflow and Windows GPO deployment are not evidence for macOS.

Manually imported .ovpn or .scx profiles do not automatically retrieve later policy changes. Auto-connect and Update policy require provisioning: on Windows with a compatible client, and on macOS from 2.1, not 2.0. auto_connect_host enables Auto-connect; Update policy becomes available after the first successful connection. Rename, Clear credentials and Delete remain separate connection actions; manual profiles require reimport after Delete.

On shared Macs, disconnect the tunnel first, then open the Sophos Connect menu at the top right, select Force SSO re-login and confirm with OK. This clears the embedded browser’s cookies, not the system browser’s cookies. If the system browser still uses the previous identity, selectively clear cookies for the relevant Microsoft Entra ID or VPN gateway domains. This may also sign out other sessions on those domains; do not clear all browser data indiscriminately.

In the pilot, check that the next user can establish the tunnel only after signing in with their own Microsoft Entra ID identity. An existing SSO login or simply disconnecting the tunnel does not prove a safe user handover. After clearing cookies, restore the session by signing in again, not by restoring another user’s cookies.

If a saved password triggers automatic sign-in and the SSO choice is missing, use Edit connection > Clear credentials. The sign-in options return at the next Connect. This removes saved credentials, not VPN authorization, and is different from Force SSO re-login. Change the client’s VPN portal port only when the administrator supplies a new value: SSO uses this port too.

Checks After Installation

Check the following after installation:

• The Sophos Connect version is compatible with the macOS version in use.
• On Apple Silicon, Sophos Connect actually starts and passes the full VPN pilot; for 2.0, check Rosetta, and for 2.1, check native ARM execution and the actual installation dialogues.
• The imported file matches the required protocol: IPsec or SSL VPN.
• The user is authorised in the correct VPN group.
• MFA works and the prompt is clear to users.
• The client receives a suitable VPN IP address.
• Internal DNS names resolve.
• Firewall rules for the VPN zone allow only the required destinations.

Acceptance Test for macOS

A green connection status is not sufficient for acceptance. For a reliable rollout, a test user should complete these checks:

1. Check the client version: The version matches macOS, IPsec or SSL VPN and the internal release.
2. Check Apple Silicon: Sophos Connect starts on the macOS version actually in use. For 2.0, check Rosetta requirements; for 2.1, check native ARM execution. A successful launch alone does not replace a connection test.
3. Import the profile: The correct file for IPsec or SSL VPN is accepted.
4. Test MFA: Signing in requests the expected second factor.
5. Test DNS: Internal FQDNs resolve correctly.
6. Test access: Permitted servers work and unauthorised destinations remain blocked.
7. Check Log Viewer: Traffic from the VPN zone matches the expected firewall rule.
8. Test reconnection: Disconnecting, changing networks and reconnecting all work.
9. Test Entra SSO from 2.1: Document the browser mode used, the required fallback, complete browser sign-in and the return to Sophos Connect. A non-compliant device remains blocked; resolve compliance issues or contact IT rather than weakening Conditional Access.

In mixed environments, test at least one Intel Mac and one Apple Silicon Mac. If Windows clients are also used, do not assume that their behaviour is identical. The platform, profile type and client version may differ.

Rollout Notes for Managed Macs

For a small number of users, manual installation with controlled profile import is often sufficient. In larger environments, treat Sophos Connect like other security-relevant client software.

Before a broad rollout, clarify:

• Which Sophos Connect version is approved?
• Which macOS versions are in use?
• Are Intel Macs, Apple Silicon Macs or both in use?
• Is IPsec, SSL VPN or both being used?
• Where do users obtain the current profile?
• Who informs users when profiles need to be imported again?
• Which update procedure is approved for the starting and target versions, and how is any required uninstallation followed by reinstallation carried out?
• Microsoft Entra ID SSO is documented for Windows from Sophos Connect 2.4 and macOS from 2.1, not macOS client 2.0. A compatible SFOS setup and a current client configuration are required. Check authentication methods and the Redirect URI; MFA remains a separate checkpoint. This does not imply an identical browser flow or that Windows GPO deployment applies to macOS.
• How does the helpdesk identify outdated profiles?
• Are the VPN Portal, MFA and certificates monitored separately?

Remove old installation packages and profiles from internal download locations or mark them clearly as outdated. With remote access in particular, using an arbitrary old profile from the Downloads folder quickly creates unnecessary troubleshooting work. The official installation guidance cited here does not describe a generic MDM deployment for the macOS package. Do not transfer Windows recipes or vendor-specific MDM parameters to macOS unless they are documented and tested for your platform.

Safely Remove or Roll Back Sophos Connect

Before uninstalling, disconnect the VPN and securely preserve the profile required for recovery. An .ovpn file contains a user-specific certificate and private key, so store it in a protected location. If Sophos Endpoint is installed with tamper protection active, do not turn it off as a precaution. The current uninstall guide no longer lists this as a prerequisite; however, the troubleshooting guidance still identifies Endpoint tamper protection as a possible cause of Sophos Connect processes not unloading and recommends a restart. The removed instruction establishes neither that protection changes are necessary nor that they will never be needed. If this problem occurs, preserve the logs, restart during a maintenance window and check again afterwards; if removal remains blocked, clarify the specific Endpoint/client combination with IT or Sophos. Change tamper protection specifically in Sophos Fusion only if a temporary protection change has been explicitly approved for this purpose. For an approved uninstallation, run the documented script with administrator privileges in macOS Terminal:

sudo /Library/Sophos\ Connect/uninstall.sh

Success is confirmed by Sophos Connect has been uninstalled. Then verify that Sophos Connect no longer starts. If tamper protection was explicitly disabled for this procedure, turn it back on and verify its active status both on the endpoint and in the management console—even if uninstallation fails. The command removes the client and should only be run during a planned maintenance window with local or alternative administrator access.

For a safe rollback, keep the previously approved macOS package under controlled access until the pilot is complete. If the new version fails, remove Sophos Connect with the supported script, install the previously approved package, import its matching profile again and repeat the full acceptance test. A rollback to a version earlier than 2.0 is unsuitable for SSL VPN because those macOS versions support IPsec only. Before rollback, preserve the version, timestamp and support report for any issue that may need escalation. Check and Securely Update Sophos Connect Client Version explains version selection and the remove-and-reinstall process in more detail. Rolling back to macOS client 2.0 does not retain native ARM execution, .pro provisioning or Entra ID SSO. If these 2.1 features are required, 2.0 is not an equivalent rollback option; approve and test a supported alternative in advance.

Diagnose and Escalate Problems

For initial diagnosis, open Events in the client or select Open VPN log from the three-dot menu. Confirm that the profile type, user identity, macOS version and Sophos Connect version match the test case. If only internal names fail, check DNS and profile currency first. If access by IP address also fails, investigate the firewall rule, routing, NAT and return path next.

Follow the symptom-based workflow in Troubleshoot Sophos Connect Client. It brings together import and sign-in failures, DNS after full-tunnel connections, an unresponsive interface, MTU/MSS and client- and firewall-side logs. Do not bypass certificate validation or security controls to make a connection work temporarily.

The Connection Is Imported but Does Not Establish

First confirm that the file belongs to the correct protocol and that the Sophos Connect version supports it. SSL VPN on macOS requires Sophos Connect 2.0 or later. Then check user authorisation, MFA, the certificate, gateway, firewall time and whether the VPN Portal or gateway FQDN is reachable. According to the SFOS 22 documentation, with SSL VPN, Login failed. Wrong fingerprint of certificate. indicates that the profile, identity, domain or authentication method may not match. Obtain and import a new .ovpn file using the authentication method that will be used for the connection. For SFOS 23, do not treat that association as a confirmed diagnosis: record the firewall and client versions and profile identity, and seek version-specific clarification from IT or Sophos; do not bypass certificate validation.

Internal Names Do Not Resolve

For SSL VPN on macOS, check the Sophos Connect version and profile currency first, then the DNS servers, search domains and firewall rules. If IP addresses work but names do not, DNS is the likely cause. If IP addresses also fail, routing, firewall rules, NAT or the return path are more likely.

The Connection Is Up, but Nothing Is Accessible

The cause is often a firewall rule, routing, NAT or the return path. Log Viewer should show whether traffic from the VPN zone matches the expected rule. For IPsec-specific cases, see Sophos Firewall IPsec VPN Troubleshooting.

The Connection No Longer Works After a Profile Change

Manually imported profiles: After changes to the gateway, certificate, port, DNS, IP pool, user group or authentication, export and import the profile again. A client update does not automatically replace an old profile, but neither does it automatically invalidate an unchanged configuration.

After a firewall restore or configuration import, compare the affected settings:

• IPsec: Reimport the current configuration file if the interface, authentication method or 2FA has changed.
• SSL VPN: If the port, protocol, interface or server certificate in SSL VPN global settings has changed, download the .ovpn again from the VPN Portal and import it.

Provisioning from macOS client 2.1: An already imported .pro automatically retrieves the appropriate IPsec and SSL VPN configurations for the user as long as the gateway address (gateway) and VPN Portal port (user_portal_port) remain unchanged. If those values change, update and redistribute the provisioning file; do not assume that the old retrieval path still works. Then check the connection, MFA, DNS and permitted access again. macOS client 2.0 still requires manual import.

The Option to Save Credentials Is Not Visible

Sophos re-enabled this option for SSL VPN on macOS in Sophos Connect 2.0 MR1. Import the configuration file again after an update. In environments with MFA, also check whether saving credentials is compatible with the security design.

Sophos Connect Does Not Open or Respond

In Activity Monitor, select the Sophos Connect process, use Force Quit, then start the application again from Launchpad. This only terminates the unresponsive interface. If the problem recurs, check the client version and support report.

Web Access Stops Working After Disconnecting

After disconnecting a full tunnel, macOS may continue using the VPN connection’s internal DNS servers. Briefly disconnect and reconnect Wi-Fi or Ethernet. If the problem recurs, document the client version, profile and DNS behaviour instead of permanently overriding the DNS servers manually.

The Connection Is Up, but Large Transfers Hang

If sign-in, DNS and small requests work but larger transfers hang, also check MTU and MSS. This pattern often indicates fragmentation, PPPoE, nested tunnels or an asymmetric path. See Check Sophos Firewall MTU and MSS for VPN Issues.

Collect Support Data

For escalation, record the time, user, macOS version, Sophos Connect version, profile type, source network and destination system. Three-dot menu > About > Generate technical support report creates scvpntsr.zip containing VPN configurations, connection events, provisioning details, SSO authentication information, browser details and endpoint information. The file may contain sensitive data and should be shared only with authorised recipients through the approved transfer channel; never copy passwords, OTPs or private keys into the ticket text. WebView2 information in scgui.log applies only to Windows, not to the macOS browser. Sophos Firewall Troubleshooting: Services and Logs maps the firewall-side log files.

For an additional read-only SCCLI check on a pilot Mac, see the macOS CLI quick reference. It replaces neither the client interface nor a successful VPN test and does not establish support for automatic MDM deployment.

FAQ