Uninstall Sophos Central Endpoint on macOS

Sophos Endpoint cannot be removed from a Mac by moving the app to the Trash. Services, system extensions, network extensions and protected components would remain. Use the installed Remove Sophos Endpoint tool, or the official InstallationDeployer for a managed removal.

The order matters: first prevent MDM from reinstalling the software and preserve any required data, then uninstall the agent locally and validate the result. Only then delete the computer from Sophos Central. Deleting the Central device record offboards its management data; it does not uninstall the software from the Mac.

Preparations

The following are required for uninstallation:

a local macOS administrator account,
if Tamper Protection is active, the individual device password or confirmation that it has been disabled for this device,
for a managed Mac, access to MDM or software distribution,
a decision whether the device will be retired, repaired or migrated to another Central tenant.

Open the device under My Environment > Computers & Servers, then open Tamper Protection to view its password. Alternatively, disable Tamper Protection for this device only and wait until the online Mac has applied the change. Disabling it globally is unnecessary for one device. An offline device cannot receive the change, so you need the device password retrieved securely beforehand.

Preserve any required alerts, forensic information and recovery data beforehand. For MDM-managed devices, also remove the installation policy from scope. Otherwise, the Mac may automatically reinstall the agent you just removed.

Recommended way: integrated removal tool

Open Spotlight with Command + Space.
Search for Remove Sophos.
Open Remove Sophos Endpoint.
Enter the local macOS administrator password and, if requested, the Tamper Protection password.
Complete the instructions and restart the Mac when the tool prompts you to do so.

Do not drag the Sophos app to the trash or manually delete directories in /Library. If the integrated uninstaller is missing or does not work, use the official standalone Removal Tool.

Supported removal from Terminal

For remote management or a controlled MDM job, Sophos documents the following commands. Run them in macOS Terminal, or in the management system’s execution context, with root privileges:

cd /Library/Application\ Support/Sophos/saas/Installer.app/Contents/MacOS/tools/
sudo ./InstallationDeployer --remove --tamper_password '<TAMPER_PROTECTION_PASSWORD>'

Replace <TAMPER_PROTECTION_PASSWORD> with this Mac’s individual Tamper Protection password. If Tamper Protection has been disabled in Central and the Mac has applied the change, the parameter is optional:

sudo ./InstallationDeployer --remove

Sophos requires sudo for command-line removal; without it, the tool opens a graphical credentials dialog instead. A password supplied as a command-line argument may be visible in management logs or process data. For managed devices, it is therefore safer to disable Tamper Protection for that device in Central, wait for synchronization, and then remove the agent without the password parameter.

If the normal process does not trigger the required macOS consent dialog, Sophos documents this variant:

sudo ./InstallationDeployer --remove --ui --tamper_password '<TAMPER_PROTECTION_PASSWORD>'

The variant is first piloted on the main macOS version actually deployed. Sophos notes that consent dialogs may differ between macOS versions due to Apple’s security changes.

Standalone Removal Tool as a repair option

If the installed uninstaller is missing or has already been run unsuccessfully, Sophos provides the Removal Tool for Sophos Endpoint for Mac. Download it exclusively via the current Sophos macOS Removal Tool page, unzip it and start Remove Sophos Endpoint. The standalone tool is a repair route, not the standard for every uninstallation.

If this tool also fails, SDU data is collected before further intervention. Do not use old cleanup scripts, third-party tools, or copied commands to manually delete protected files.

Handle MDM profiles and extensions separately

The Sophos uninstaller removes the installed endpoint components. An MDM configuration profile, on the other hand, is part of device management and is not treated like an app. After uninstallation, a separate decision is made:

The Mac stays in the organization or will be reimaged: Remove Sophos profiles from scope only if no other assigned Sophos configuration still needs them.
The Mac leaves device management: Remove the Sophos profiles through MDM and verify that they are not assigned again.
Migration to a new tenant: Remove the old installation assignment and obsolete profiles, then deploy the current profiles and installer from the new tenant.

Do not delete System Extensions or Network Extensions manually. If macOS continues to show an extension after successful uninstallation, first restart and check MDM assignments. If it persists, preserve the logs and contact Sophos Support. The separate installation process, including profiles, Full Disk Access and rollout validation, is explained in Deploy Sophos Endpoint on macOS with MDM.

Check success and clean up Central

After a requested restart, check that:

Sophos Endpoint and the menu bar icon no longer appear,
in Activity Monitor no remaining Sophos processes are running,
the Mac does not contact the old tenant again after a few minutes,
MDM or software distribution does not start a new installation,
Sophos MDM profiles that are no longer required have been removed or are out of scope.

Only after these checks pass should you remove the old device record from Central. For a tenant migration, then install and validate it in the new tenant: check the device identity and group, assigned policy, green health status, update status and last communication.

If uninstallation fails

Do not repeatedly delete files and directories manually.
Note macOS and Sophos agent version, local admin rights, tamper protection status, method used, time and exact exit code.
Check MDM status and existing Sophos profiles. A reinstall job may seem like a failed uninstall.
Collect current SDU logs before the next intervention.
Open a Sophos Support case with these details and logs.

If the device has already been deleted, Sophos says it can be restored to Central for 30 days; deleted devices and their Tamper Protection passwords remain in the recovery report for 120 days. If the password, restoration and regular removal tools do not resolve the issue, there is a recovery mode procedure that depends on the version and FileVault. It changes product information on the correct APFS Data volume and must therefore be performed only according to the current Sophos recovery guide or with Sophos Support. Do not reuse commands from old tickets.

Manual installation explains Install Sophos Central Endpoint on macOS. The time-limited local override and password recovery is described in Safely disable Sophos Central Tamper Protection.

These instructions are based on the current Sophos documentation:

FAQ

Can Sophos Endpoint be moved to the Trash on a Mac?

No. This would result in services, extensions and protected components not being removed cleanly. Use the Sophos Removal Tool.

Does Tamper Protection have to be disabled globally?

No. For a single Mac, deactivation on the device object or the individual tamper protection password are sufficient. Global deactivation unnecessarily increases the attack surface.

Does deleting the Mac in Sophos Central also remove the agent?

No. The Central device object and the locally installed software are separate. First uninstall and validate the agent on the Mac, then remove the device record.