Configure Sophos Central Endpoint exclusions safely
A Sophos Endpoint exclusion is not a harmless compatibility setting. It removes files, processes, websites or certain controls partly or completely from inspection. An overly broad exclusion can open the exact route later used by malware.
First identify the cause and protection component, then use the narrowest possible exclusion in a targeted policy. Global exclusions are the last step, not the first.
Policy or global?
| Scope | Location | Suitable for |
|---|---|---|
| selected users, devices or groups | Threat Protection policy | standard case |
| all users, computers and servers | Global Exclusions | only a tenant-wide requirement |
| detected legitimate application | Allowed Applications | verified false positive |
Policy exclusions remain limited to the target. Global exclusions apply across the tenant and greatly increase the impact of a mistake.
The current global path is Global Settings > Protection and Remediation > Allow and Block > Global Exclusions.
Before every exclusion
A valid request includes:
- detection name and timestamp
- affected device and user
- full path, process or destination
- Sophos event and triggering protection feature
- vendor recommendation for the current product version
- hash and digital signature when a file is involved
- smallest required target group
- expiry date and removal test
“The application is slow” is insufficient. CPU, disk, file type, process chain and an actual Sophos event must demonstrate the relationship.
Choose the correct exclusion type
File or folder
A full path is more precise than a file name, wildcard or entire directory. On Windows, *.* is not a valid blanket wildcard. Do not exclude high-level locations such as profiles, Temp, Windows, ProgramData or entire drives.
A scanning exclusion does not automatically bypass every other inspection. Exploit, ransomware or behavioural detection may still apply. Identify the component first.
For a slow application, Sophos does not automatically recommend excluding the entire data directory. If C:\app\app.exe incurs overhead while reading or writing in C:\data, the exact process path is usually narrower: other processes and malware continue to be scanned in the data directory.
Windows wildcards must be interpreted precisely. * does not cross a path separator, ** can span several directory levels and ? represents one character. A pattern such as C:\foo\**\bar is substantially broader than a specific file. Variables such as %PROGRAMDATA%, %USERPROFILE%, %TEMP% or %WINDIR% can cover large, frequently abused areas and should not be used on their own.
On macOS, a trailing slash has a distinct meaning: /myfolder/ includes subfolders recursively, while /myfolder// includes only the folder without subfolders. An asterisk at the end of a path matches files, not automatically subfolders. Windows patterns must therefore not be transferred unchanged to Macs.
Process
A Windows process exclusion requires the application’s full path. It can also affect files accessed by that process and is often broader than expected.
A bare app.exe is not a precise definition. Writable installation paths and user profiles are especially risky.
Website
A website exclusion can bypass category checks and Web Control. It accepts a domain, IP address or CIDR range. Wildcards are not supported in Website Exclusions. Allow only the required host, not an entire top-level domain.
Exploit, ransomware or IPS exclusion
These types affect specific protection modules and are used only when the event proves that component is involved. A normal scanning exclusion does not automatically resolve an exploit-mitigation issue.
For an exploit false positive, first exclude the Detection ID. This restricts the effect to that specific detected behaviour. Excluding the entire application from all exploit checks is the highest-risk option and remains the last step.
A current compatibility example involves the Omnissa Horizon 2503 Agent, its Redirection Scanner and Sophos Core Agent 2025.x. If several applications start crashing only after this upgrade, first verify whether Scanner Redirection is required at all. If it is unused, remove it from the Horizon Agent. Otherwise test the process-specific compatibility setting specified by Omnissa Support and, only as a last option, a narrowly scoped Sophos Exploit Mitigation exclusion. Back up the registry and use a pilot device before the change; a blanket exclusion for every crashing application would reduce protection unnecessarily.
An IPS exclusion restricts direction, remote address, remote port and local port. At least an address or port must be set. For inbound RDP from an administration device, for example, use local port 3389 with the exact remote address, not an arbitrary source port.
Device Isolation
Isolation exclusions permit narrowly restricted communication while an Endpoint is isolated. A local port allows other devices to access that port on the isolated system. A Remote Port or Remote Address restricts outbound connections from the isolated device.
For an investigation, for example, allow inbound RDP on port 3389 or SSH on port 22 only from an administration network. For cleanup tools, permit an outbound connection to a specific tool server. General internet access would undermine the purpose of isolation.
PUA and detected application
A PUA is not necessarily malware but may be unsuitable for the organisation. Global Authorize PUA allows it on every computer, while a policy exclusion can limit the scope.
Allow a false-positive application
Manage approved applications under Global Settings > Protection and Remediation > Allow and Block > Files > Allowed Applications.
Allowing prevents the same detection and can restore cleaned copies from SafeStore. It applies to all users and computers, so use it only after verification.
Sophos offers several identities depending on the platform:
| Method | Effect | Assessment |
|---|---|---|
| Certificate | allows applications signed with the trusted certificate | preferred after verifying publisher and certificate |
| SHA-256 | allows exactly this file version | narrow, must change after updates |
| Path | allows applications at the defined location | riskier in writable paths |
Certificate is Sophos’ preferred method but may include other applications from the same publisher. Verify the certificate owner.
Block a suspicious application by hash
With a Sophos XDR licence, suspicious Windows applications can be blocked tenant-wide by their SHA-256 hash under Global Settings > Protection and Remediation > Allow and Block > Files > Blocked Items. Existing copies are cleaned up on computers. The list supports up to 5,000 hashes and shows the reason and author for each block.
This is not a general file block list. Sophos accepts only applications considered suspicious based on their reputation and ignores hashes for other file types or files with a trusted reputation. Before adding an entry, therefore check the hash together with the file path, signature and Detection. The Detection Event or Threat Graph provides the SHA-256 value for a detected file; for a file not yet detected, use Endpoint Self Help > File Info.
Removing a hash permits the application to run again, but does not automatically restore a previously cleaned-up file. After verifying a legitimate false positive, allow the application through Allowed Applications.
Test and rollback
- Create the exclusion in a small pilot policy.
- Reproduce the application and original problem.
- Check Sophos events and health state.
- Confirm only the intended path or process matches.
- Expand the target only after validation.
- Record owner and expiry date.
- Remove and retest after the vendor or Sophos provides a fix.
An exclusion without a rollback test quickly becomes permanent technical risk.
Clean up existing exclusions
At least quarterly, review global and policy exclusions. Remove entries without owners, expired workarounds, uninstalled applications, duplicates and broad wildcards.
Account Health Check can reveal particularly unsafe global and policy exclusions. A green result confirms only that Sophos did not find the high-risk patterns recognised by that check. It does not replace a technical review of the exclusion’s purpose.
Common mistakes
A vendor requests an entire directory tree
Check the recommendation against the current product version and actual writable paths. It can often be reduced to database files, cache or a signed process.
The event disappears after a global exclusion
This proves only that inspection was bypassed. It does not prove that the file is safe or the exclusion appropriate.
An allowed application still does not work
Malware detection may not be the cause. Exploit Mitigation, Peripheral Control, Web Control, DLP or another product may be involved. The event type determines the next step.