Map Sophos Central Endpoint users and groups correctly
A Windows login, a Sophos Central user and a protected computer are three different objects. Sophos associates them, but they have their own groups, policies and lifecycle rules. Many apparent policy errors arise because these levels are confused.
User, login and device
| Object | Meaning | Typical use |
|---|---|---|
| User | person in Sophos Central | user policy, licence and Event association |
| Login | detected local or domain sign-in name | associates a sign-in with a Central user |
| Computer | managed Endpoint agent | computer policy, group, Health and software |
One user can have several devices. Several users can appear on a shared computer.
How users are created in Central
Users can be created in four ways:
- automatically when somebody signs in to a protected computer,
- manually under My Environment > Users & Groups > Users,
- through CSV import,
- through a Directory Service such as Active Directory or Microsoft Entra ID.
Define one primary identity source for a production environment. A mixed model is useful only when it is clear which source provides which objects.
Automatically detected logins
Where possible, Sophos reports Windows users with their domain, such as CORP\muster. Without a domain, entries such as PC01\user and PC02\user can be created across several computers.
Do not delete these logins indiscriminately. First determine whether they belong to the same person and which policies or Events depend on them. Then open the user under My Environment > Users & Groups, select Edit next to Logins, and move the entry between Available Logins and Assigned Logins. After saving, the already assigned computers appear on the user’s Summary page.
The naming strategy is particularly important on Macs and for local Windows accounts. During a new macOS installation, --mcsPreferHostname makes Sophos report usernames as domain\username instead of machine\username. This option can only be set during a new installation.
On an already installed Mac, check domain discovery through Samba:
scutil
show State:/Network/Global/SMB
Only if the correct domain is shown should reporting for domain-managed accounts be enabled:
sudo defaults write /Library/Preferences/com.sophos.mcs SMEMcsPreferDomainName -bool true
sudo launchctl stop com.sophos.configuration
Local accounts continue to be reported with the computer name. If macOS cannot discover a domain, Sophos also falls back to the computer name. Validate the change by signing in again and then checking the login assignment in Central.
Create users manually or by CSV
A manually created user requires a unique name and, for invitations or Self Service, a valid email address. An email address can be used in only one Sophos Central dashboard. If a user role cannot be changed because the address is already registered, release it in the other tenant first. If that tenant is no longer accessible, Sophos Support needs the old and new tenant, licence, and address details for manual cleanup.
Test CSV imports with a few accounts first. The file must be no larger than 2 MB and encoded as UTF-8. Large imports can end after five minutes in an endless loading screen without a useful error. Import batches of no more than 1,000 users; if a timeout remains, reduce to 500 and retry outside peak hours for the data region.
Before importing, check:
- email addresses are unique,
- existing Directory Sync users are not duplicated,
- special characters and delimiters are correct,
- the group and policy target model is prepared,
- deactivation and deletion are defined.
Check the result page after every batch. If the interface hangs, refresh it and inspect the inventory before importing the same batch again. This prevents unnoticed duplicate creation.
User groups and policies
Manage user groups under My Environment > Users & Groups > Groups. They can be created locally or synchronised from a directory source.
A user group is appropriate when a policy should follow a person across several devices, such as Web Control for a business function or DLP for a particularly sensitive area.
A computer group is appropriate when protection depends on the device, such as kiosk, lab or production systems.
When user and computer policies of the same type match, policy order decides. The target type has no automatic priority.
Directory Sync without duplicates
Do not synchronise users from the same domain indiscriminately from both on-premises AD and Entra ID. Sophos supports certain combined models, such as AD for devices and Entra ID for users. Check the boundaries before migration.
For Microsoft Entra ID, see Synchronise Microsoft Entra ID with Sophos Central. Synchronise Active Directory with Sophos Central explains on-premises directory sync.
Verify policy assignment
The Policies tab on the user object shows which user policies apply. Check the effective device assignment on the computer object.
For an unexpected setting, check in this order:
- Which user is currently signed in?
- Which Central user is the login associated with?
- Which user and computer groups contain the objects?
- Which active policy appears first in the list?
- When did the Endpoint last synchronise?
Protect a user and send the installer
Central can send selected users a personalised installation email. The path is My Environment > Installers > Endpoint > Send Installers to Users. Select the recipients under Users & Groups; under Email Setup Link > Deployment Emails, enable Computers for Endpoint and save. Central sends the message from do-not-reply@central.sophos.com. After installation, the device is associated with the user automatically.
The recipient needs local administrator permissions and internet access. This convenient method is suitable for controlled individual installations. For a mass rollout, software distribution, group path, logging and piloting provide better traceability.
Export and review the inventory
Export to CSV exports exactly the currently filtered user list. This allows, for example, only administrators, users from one source or unresolved accounts to be written to users.csv. For a periodic review, document the filter name, export time and purpose so that the selection can be reproduced later.
The user Events tab combines detections across all assigned devices. However, an Allow or Exclude action offered there can have a global effect. Before approving anything, open the specific computer, Event and Detection details and use the safe exclusion process.
Delete a user
Delete a user only after checking logins, devices, Events, policies and the directory source. Admins and Super Admins can delete ordinary users; only a Super Admin can delete an administrator. Even a Super Admin cannot delete their own account. For synchronised users, make the change at the source in normal circumstances. Otherwise, the object can reappear at the next sync.
Deleting a user does not uninstall an Endpoint agent. Likewise, deleting a computer does not automatically remove the local agent.
Common errors
User policy does not apply
Often, another login is associated with the device, the policy is too far down the list, or the device has not contacted Central since the change.
User appears several times
Several local computer names may report the same short name, or two directory sources may provide similar identities. Compare the email address, domain login and source ID before merging or deleting entries.
Deleted user reappears
A Directory Service or another local sign-in creates or synchronises the object again. Make the change at the actual source.