Deploy Sophos Endpoint on macOS with MDM
A macOS rollout is complete only when the agent is installed and every security permission required by that macOS version is granted. Jamf Pro or another MDM therefore distributes not only SophosInstall.zip, but also current profiles for System Extensions, Web Content Filter, Notifications and Full Disk Access.
Required permissions differ between macOS 14, 15 and 26. Do not reuse old profiles uncritically; compare them with current Sophos templates before every major macOS or Sophos release.
Provide the installer correctly
Download a fresh Endpoint installer from the correct tenant under My Environment > Installers. If Update Caches or Message Relays changed after download, download a new macOS installer because its configuration may contain the earlier state.
Since macOS Monterey 12.4, the ZIP for automated installation must not be unpacked and launched from Documents, Downloads or Desktop. Move it to a managed temporary path. For manually transferred files, also check quarantine status.
The installer remains confidential. It registers new devices in the tenant and must not be placed in a public package repository.
MDM profiles before software
Assign configuration profiles before, or at the latest together with, the software. Otherwise the agent can be installed while macOS blocks protection modules and Central reports red Health.
Depending on Sophos and macOS versions, a production baseline includes at least:
- allowed Sophos System Extensions
- Web Content Filter or Network Extension
- Full Disk Access for documented Sophos processes
- Notifications
- managed Login or Background Items where required
Sophos-provided profiles are the source for Bundle IDs and Team IDs. Do not copy values from a blog post or old tenant.
Under My Environment > Installers > Download macOS Deployment Tools, Sophos provides SophosMacDeploymentTools.zip with separate profiles for Sophos Endpoint and Sophos Endpoint with ZTNA. These profiles are digitally signed and should, where possible, be imported directly into the MDM without modification. If an MDM solution does not accept signed .mobileconfig files, remove the signature only within a controlled chain between the direct Sophos download and MDM import. Do not distribute the resulting unsigned XML profile or archive it as a permanent template.
When using Sophos Mobile in Central as the MDM, import the profiles under My Products > Mobile > Policies > macOS > Create > Import policy. Import the appropriate profile for every deployed macOS version and for the variant with or without ZTNA, then assign it to devices or device groups. The assignment becomes effective only after the next device synchronisation.
Jamf Pro workflow
In Jamf Pro, manage profiles, installation package and policy separately. The installation policy uses a repeatable trigger such as Recurring Check-in and a clearly bounded pilot scope. A Smart Group criterion verifies that agent and permissions are complete.
The script checks the download, unpacks to an allowed path, starts the Sophos installer and writes an unambiguous exit code to the Jamf log. Do not hide failure through continuous reinstallation. Devices missing profiles receive configuration first.
Command-line options
The macOS installer supports --quiet --install, --devicegroup, --messagerelays, proxy parameters, --computernameoverride, --domainnameoverride, --customertoken, --products and --tag.
XDR Sensor requires at least macOS 13 and active third-party protection. It supplies detection and telemetry, not malware protection. Full endpoint or xdr installation is a different operating model.
Sophos also supports a Property List for overrides. Validate syntax and values before bulk rollout. A damaged plist can install devices into the wrong group or connection path.
Check permissions
Sophos Service Manager checks permissions about every 30 minutes, so an MDM correction may not appear immediately in Central. For direct diagnosis use Endpoint Self Help, Sophos Events and documented terminal checks.
Full Disk Access is particularly important. Without it, files or user areas may be checked incompletely. A green installer result without this permission is not successful protection acceptance.
Sophos Updater also needs current permissions. Missing permissions cause update failure and red Health. On Jamf devices, check both protection modules and updater status and last update.
Accept the rollout
The pilot includes at least two supported major macOS versions, an Intel Mac and, where available, Apple Silicon. Check:
- device appears in the correct tenant and group
- Agent Mode and licence scope are correct
- all System Extensions are loaded
- Full Disk Access and Web Content Filter are active
- updates work
- a test Event appears in Central
- uninstall and rollback are documented
Expand scope in stages only afterwards. Test a macOS upgrade as a separate change because it can alter permission and extension behaviour.
Troubleshooting
For red Health, first check missing permissions and blocked extensions. Even if Jamf shows profiles as installed, verify local TCC and extension state. “Profile delivered” does not always mean “permission effective”.
If the installer does not start, check path, quarantine attribute, ZIP integrity and administrator rights. For communication failures, check proxy, Message Relay and required Sophos domains.
Related articles
The manual process is in Install Sophos Central Endpoint on macOS. Connection and proxy requirements are covered separately.