Skip to content
Avanet

Sophos Endpoint network and proxy requirements

Sophos Endpoint

Sophos Central Endpoint requires outbound port 53 (DNS) and port 443 (HTTPS). On a network that denies outbound traffic by default, you must also allow every current destination relevant to the operating system and licensed features. Sophos states that Sophos Firewall allows the required Central domains and ports by default, so this article is mainly for other firewalls and proxies.

The safe short path is to use wildcards where the rule engine supports them, allow ports 53 and 443, choose the intended proxy path, and then test installation, management, and updates from every relevant network. Static IP or country lists are not substitutes: Sophos uses AWS with non-static addresses and warns that regional firewall rules can override allowed destinations.

Domains to allow

For Endpoint, EDR, XDR, and MDR, Sophos documents these core wildcards:

*.sophos.com
*.sophosxl.com
*.sophosxl.net
*.sophosupd.com
*.sophosupd.net
*.hitmanpro.com

The general Central destinations central.sophos.com, cloud-assets.sophos.com, sophos.com, and downloads.sophos.com are covered by *.sophos.com. You must also allow az416426.vo.msecnd.net and dc.services.visualstudio.com. If Certificate Authority destinations are not already permitted, Sophos also lists *.globalsign.com, *.globalsign.net, and *.digicert.com.

This is not an arbitrarily reducible selection: Sophos says to complete every section of its official list. License-dependent destinations, including those for XDR or MDR, and platform-specific destinations may also be required. Recheck the current Sophos list for each change rather than copying this article into a permanent firewall object.

If wildcards are unavailable

Without wildcard support, maintain the exact destinations from the official list individually. Sophos warns that some features then cannot be used. Identify the registration and management servers actually used by each platform as follows:

  • Windows: Open C:\ProgramData\Sophos\CloudInstaller\Logs\SophosCloudInstaller.log, find lines beginning with Opening connection to, and allow both domains found there.
  • macOS: Extract SophosInstall.zip, open Sophos Installer Components/SophosCloudConfig.plist, and allow the domain in the value following RegistrationServerURL.
  • Linux: From the directory containing SophosSetup.sh, run the installer with sudo bash -x ./SophosSetup.sh. Allow the domains shown on the + CLOUD_URL=https:// and + MCS_URL=https:// lines.

This discovery does not replace the other platform, MCS, Intelix, CA, and, where applicable, XDR or MDR entries on the official page. It matters because regional destinations can change.

Configure the proxy and understand priority

Go to Global Settings > Products and Services > Endpoint and Server > Proxy Configuration and turn on Proxy Configuration. Enter the hostname, port, and optional username and password. Alternatively, enter a PAC file URL in PAC Url, for example http://your.organization.com/pacfile.pac. Sophos cannot recover a stored proxy password, so clicking Save may overwrite an existing password.

Windows, macOS, and Linux devices use the first working configuration in this officially documented order:

  1. Sophos Central message relay
  2. proxy configured in Sophos Central
  3. default system proxy
  4. Web Proxy Auto-Discovery (WPAD)
  5. connection without a proxy

WPAD is not supported on Linux. Because a later option can succeed as a fallback, successful communication alone does not prove that the intended proxy was used. In tightly controlled networks, deliberately restrict unwanted fallbacks and confirm the path in proxy or firewall logs.

Windows installation-time proxy parameters belong to the deployment workflow and are covered in Automate Sophos Endpoint rollout on Windows. See Sophos Endpoint updates, Cache and Message Relay for Update Cache and Message Relay.

Do not confuse TLS inspection with the allowlist

Allowing a domain and exempting it from TLS inspection are separate decisions. The Sophos pages reviewed here require the domains and CA destinations, but they do not document a blanket TLS-inspection exception for every listed wildcard. Do not copy the list unchecked into a global no-decrypt rule.

If a firewall or proxy intercepts HTTPS, the pilot must demonstrate that installation, management, and updates still work. If only the inspected path fails, first test a narrowly scoped inspection exclusion for the specific, currently documented Sophos destination involved. Limit any permanent exception to demonstrated destinations and review it when the official list changes. This avoids both claiming an unsupported blanket exception and assuming that agent communication works.

Validate communication

Test with a real pilot endpoint, not only an administrator’s browser, and repeat the test from every intended segment, VPN, and mobile network:

  1. DNS resolution and outbound connections on ports 53 and 443 to all required destinations are allowed.
  2. For rules without wildcards, installer-discovered registration and MCS destinations match the allow rules.
  3. The endpoint appears as managed in Sophos Central and receives policies.
  4. Updates and licensed features work over the intended path.
  5. Proxy or firewall logs show the expected proxy or message relay rather than an unintended fallback.

For failures, narrow the path in this order: DNS, TCP 443, proxy authentication, TLS inspection, domain allow rule, and Central service status. Compare repeated server errors with Sophos Central Status and the exact time window before continuing local investigation.

Sources

Frequently asked questions

Which ports does Sophos Central Endpoint require?

For Endpoint, EDR, XDR, or MDR, Sophos lists outbound port 443 for HTTPS and port 53 for DNS. Message Relay and Update Cache have separate requirements covered in the linked detail article.

Is the wildcard list automatically a TLS-inspection exclusion list?

No. The official pages substantiate network allow rules, but not a blanket no-decrypt rule for every wildcard. Validate inspection and any exclusions separately with a pilot endpoint.