Skip to content
Avanet

Install Sophos Central Endpoint (macOS)

Sophos Endpoint

Sophos Central Endpoint only fully protects a Mac once the agent is installed and the extensions and privacy permissions required by macOS have been granted. This guide covers a manual installation, explains how to select the right installer, and shows how to verify protection afterwards.

Important: A full Sophos Endpoint installation should not run alongside another antivirus product. The separate XDR Sensor is the exception: It is designed to run with an existing third-party antivirus product, but does not provide malware protection itself.

Before installation

The following requirements should be confirmed before downloading the installer:

When migrating from another endpoint solution, its removal should first be tested on a small number of Macs. This confirms whether old system or network extensions remain and interfere with the new agent.

Download the appropriate macOS installer

  1. Sign in to Sophos Central Admin at central.sophos.com.
  2. Open My Environment > Installers.
  3. Under Endpoint, select the appropriate macOS installer.
  4. Download SophosInstall.zip.

Sophos Central provides several options:

  • Download Complete macOS Installer: Installs the endpoint products covered by the licenses in the Central account.
  • Choose Components: Creates an installer containing only the selected components. This is useful when, for example, Device Encryption or ZTNA should not be installed on the Mac.
  • XDR Sensor Installers: Installs only the XDR Sensor for detection and investigation alongside an existing third-party antivirus product. An XDR-capable license and at least macOS 13 Ventura are required. This sensor does not replace antivirus protection.

The complete installer is normally appropriate for a standard workstation that will be fully protected by Sophos. Choose Components should be used when the intended product combination deliberately differs from the licensed set.

Install Sophos Endpoint manually

Starting with macOS Monterey 12.4, SophosInstall.zip must be moved from Downloads, Documents, or the desktop to the user’s home directory before extracting it. Otherwise, the installer cannot create its working files correctly and the installation fails.

One possible destination is:

~/SophosInstall

Then:

  1. Extract the ZIP file in the destination folder.
  2. Start Sophos Installer.app.
  3. Confirm the administrator credentials.
  4. Complete the installation.
  5. Grant the Sophos extensions and permissions requested by macOS.

The installer downloads additional components from Sophos Central. A successfully started installation wizard therefore does not by itself prove that the Mac is fully protected.

Install from Terminal

For an unattended installation of Sophos Anti-Virus and Intercept X, run the extracted installer in Terminal:

cd ~/SophosInstall
sudo ./Sophos\ Installer.app/Contents/MacOS/Sophos\ Installer \
  --products antivirus intercept \
  --quiet

--products antivirus intercept defines the protection components to install. --quiet hides the installation dialog, but does not replace the required macOS permissions. Before a wider deployment, product names and options should be tested with a current installer on a test device.

To assign the Mac directly to a Central device group during installation, specify the group as follows:

sudo ./Sophos\ Installer.app/Contents/MacOS/Sophos\ Installer \
  --products antivirus intercept \
  --devicegroup Firma\\Macs \
  --quiet

In this example, Firma\Macs is an existing Central subgroup. The double backslash ensures that the shell passes the group path to the installer correctly.

If macOS blocks the installer

First check whether macOS has added a quarantine attribute to the installer:

xattr ~/SophosInstall/Sophos\ Installer.app

If com.apple.quarantine is shown and the file was downloaded directly from the organization’s own Sophos Central account, remove the attribute only from the Sophos installer:

sudo xattr -r -d com.apple.quarantine \
  ~/SophosInstall/Sophos\ Installer.app

This does not disable Gatekeeper globally. The attribute must not simply be removed from an installer obtained from an unknown source.

Grant macOS permissions

Depending on the licensed products, Sophos requires a security extension, a network extension, proxy approval, and Full Disk Access. If one of these permissions is missing, the agent can be installed and visible in Central while individual protection functions still do not operate.

The exact interface varies by macOS version:

  • macOS 14 and earlier: Allow the Sophos system extensions under Privacy & Security.
  • macOS 15: Open System Settings > General > Login Items & Extensions. Under Endpoint Security Extensions, enable Sophos Detection.app; under Network Extensions, enable Sophos Network Extension.app.
  • macOS 26: In the same location, under By App, enable the security extension for Sophos Detection and the network extension for Sophos Network Extension.

After enabling the network extension, macOS asks whether Sophos Network Extension may be allowed as a network proxy. Confirm this dialog with Allow so that scanning and web protection can operate fully.

The most reliable way to check and grant Full Disk Access is through Sophos Endpoint:

Sophos Endpoint > About > Open Endpoint Self Help Tool > Prerequisites

Under Prerequisites, Sophos shows which permission is missing and opens the corresponding macOS setting. Required entries can change with the agent version and licensed products, so this check is more reliable than a static list.

Verify installation and protection

After installation, verify three levels:

  1. Locally: No permissions are missing under Endpoint Self Help > Prerequisites.
  2. Sophos Central: The Mac appears under My Environment > Computers & Servers, communicates with Central, and does not have a red health status.
  3. Protection scope: The expected products and policies are active on the device details page.

A device should not be deleted from Sophos Central prematurely. Removing the Central object does not uninstall the agent, but can make normal access to the device-specific tamper protection password more difficult. First disable tamper protection in a controlled manner, then uninstall the agent.

Sophos Central normally detects signed-in users automatically. Manual user or license assignment is mainly required when different local sign-in names have created duplicate user objects.

Features installed later can be managed separately. The article Install or uninstall Sophos Endpoint features explains the process.

Deploy multiple Macs through MDM

For multiple Macs, permissions should not be confirmed manually on every device. Under My Environment > Installers, the SophosMacDeploymentTools.zip package is available under Deployment Tools. It contains MDM profiles and installation scripts for Sophos Endpoint and Sophos Endpoint with ZTNA.

The order is important:

  1. Select the appropriate profile for the product combination and macOS version.
  2. Deploy the MDM profile to the test devices first.
  3. Confirm that the profile was installed.
  4. Then run the installer or the included installation script.
  5. Check the MDM policy and Endpoint Self Help > Prerequisites.

Sophos documents this process for Jamf Pro. The profiles and scripts can generally be used with other MDM solutions as well, but must be validated through the organization’s own testing and approval process.

Common installation issues

The Mac does not appear in Sophos Central

Check the internet connection, DNS, system time, and proxy. With restrictive egress rules, the current Sophos domains must be reachable. Also confirm that the installer was downloaded from the correct Central account.

The agent is installed, but the status remains red

Check Endpoint Self Help > Prerequisites for missing system, network, or privacy permissions. On macOS 14 and 15, missing Full Disk Access for SophosUpdater in particular can cause update failures.

Search the relevant log as follows:

sudo log show \
  --predicate "subsystem == 'com.sophos.macendpoint'" \
  --last 1d |
grep -i 'Error renaming Installer directory'

A match indicates that SophosUpdater could not rename its installer directory. In this case, deploy the current MDM profile or grant /Library/Sophos Anti-Virus/SophosUpdater.app Full Disk Access.

Another antivirus product is already installed

For full Sophos protection, the existing antivirus product should be migrated and removed in a controlled manner. If the existing protection is deliberately retained, only the separate XDR Sensor is intended for this coexistence. Because it does not provide malware protection of its own, the third-party antivirus product must remain active and healthy.