Plan Sophos Fusion Endpoint roles and permissions
Sophos Fusion (formerly Sophos Central) roles affect more than the menus visible to an Endpoint administrator. Product access, Access Type and additional capabilities jointly determine whether an admin can change policies, start Live Response, enable Data Lake uploads, turn off Tamper Protection or release a computer from isolation.
The Central administration roles runbook covers tenant-wide selection, assignment and review of predefined and custom roles. This article focuses on their Endpoint and XDR effects instead of repeating user creation, role changes and offboarding.
Use an Endpoint Custom Role instead of blanket full access
Only a Super Admin can create a Custom Role. Open Global Settings > Access Control > Admins and Roles > Roles > Add role, enter a clear Name and purpose-specific Description, choose the Base role, and set the required Access Type (Full, Help Desk, Read-only or None) for each product. In the custom role’s additional access and management options, enable only the required capabilities and select Save. Then open the role, select Edit next to Role Members, choose the administrators and save again.
A practical Endpoint Help Desk role might be structured as follows:
- base role
Help Desk - product
Endpoint Protection - Access Type appropriate to the actual task
- all unnecessary products set to
None - Logs and Reports only where operationally required
- decide separately on policy management and policy assignment
- do not enable Live Response, Data Collection and isolation automatically
Additional options apply only to the products selected in the role. Besides logs, policy permissions and Live Response, there are separate computer and server controls, Enable global search management, Tamper Protection and removal from isolation. Global Search requires Endpoint Protection or Server Protection with the Full Access Type.
After every role change, use a test account to verify which menus, devices and actions are actually available. A role name is not evidence of permission.
Shared Settings require several product permissions
Some settings are shared by Endpoint and Server. If a Custom Role does not have access to both products, some of these Shared Settings remain read-only. Individual functions also require Encryption access.
Shared settings include:
- Tamper Protection
- allowed applications
- Website Management
- proxy configuration
- Blocked Items
- bandwidth usage
- DLP rules and Content Control Lists
- rejecting network connections to unsafe devices
- XDR Threat Analysis Center
This is a common reason why an apparent Endpoint Full role cannot change a global exclusion or shared setting. The answer is not automatically Super Admin, but a deliberately extended Custom Role.
Grant policy permissions separately
Sophos distinguishes between managing and assigning policies:
- Enable policy management permits creating, editing and deleting policies.
- Enable policy assignment permits enabling or disabling existing policies and assigning users, groups, devices or device groups.
An operations team can therefore assign policies without being permitted to change the protection baseline itself. Conversely, a security team can maintain policy content while production assignments follow a change process. Structure Sophos Fusion Endpoint policies correctly describes structure and priority.
Live Response and data collection
Permission to start a Live Response session is set explicitly. A Custom Role needs the Full or Help Desk base role, Endpoint Protection with the Full Access Type and Start Live Response sessions on computers. Server access is granted separately with Start Live Response sessions on servers and requires Server Protection with Full. Live Response requires a Sophos EDR, XDR or MDR licence.
Manage Data Collection and Investigation settings for computers is another separate permission. It allows Live Response and Data Lake uploads to be enabled in the computer policy and requires Endpoint Protection with Full. Servers have an equivalent separate option requiring Server Protection. Starting a session and enabling the feature are therefore two different tasks.
A current restriction applies to MSPs: an MSP who opens a customer tenant from Sophos Fusion Partner cannot currently create this Live Response Custom Role. In that access context, a missing button is therefore not a local permission error.
Live Response provides a powerful remote shell. Role approval, MFA, audit and the session workflow are covered in Isolate a Sophos Endpoint and investigate with Live Response.
Tamper Protection and isolation
Turning off Tamper Protection and removing a computer from Admin Isolation are not casually enabled through general Help Desk access. For these options, Sophos requires a Custom Role with the Help Desk base role, Endpoint Protection and the Full Access Type.
Grant these permissions only to people who perform a documented maintenance or incident process. Permanent access for the entire first-level support team is rarely appropriate.
Additional XDR permissions
With an XDR licence, the standard roles receive additional capabilities:
- Super Admin and Admin can request Intelligence Reports, manage Clean and block entries, view Blocked Items, request On-Demand Threat Graphs, isolate or release devices, and request Forensic Snapshots.
- Help Desk can request Intelligence Reports and Threat Graphs, view Blocked Items and request Forensic Snapshots, but cannot perform every response action.
- Read-only can view Intelligence Reports, Blocked Items and existing On-Demand Threat Graphs.
The actual interface also depends on the licence, product assignment and data source. Test XDR functions with a representative device. Manage Sophos XDR Cases and Detection Suppression Rules explains Cases, Suppression Rules and exposure data.
Validate and troubleshoot
Use a test administrator and at least one representative computer for acceptance; add a server when testing server permissions. Check sign-in, visible products, Logs & Reports, policy editing, policy assignment and every approved response action separately. Negative tests must confirm that unapproved products, settings and actions are absent or read-only. Document role membership and results, then check the Audit Logs.
If a feature is missing or disabled, check the licence and data source first. Then confirm Role Members, sign in again, and compare Base role, product, Access Type and the additional option. For Shared Settings, verify combined Endpoint, Server and possibly Encryption access. For Live Response, also check the relevant Data Collection and Investigation policy: permission to start a session does not enable the feature. Finally, rule out access through Sophos Fusion Partner and a browser blocking the new Live Response tab. Record the tenant, user, role, product page, device, time and negative-test result before escalation.