Sophos Endpoint Standard or Advanced: current mapping
Older Sophos Fusion (formerly Sophos Central) instructions distinguish between Endpoint Standard and Endpoint Advanced. These names are no longer reliable selection criteria for a current Windows rollout. In Sophos Fusion, the available licence, offered products and Agent Mode determine which protection components a device receives.
Anyone adopting an old installation process should therefore not look for a new installer with the same name. First determine the protection that is operationally required. Then select the installer offered in the organisation’s own tenant and validate it on a pilot device.
Do not translate old terms directly
“Standard” and “Advanced” described former feature packages. They cannot be mapped permanently to one current licence or setup file. Sophos may develop product names, bundles and licence entitlements further, while an existing agent can receive or lose additional components through Manage Software.
For technical installation, these Agent Modes are now the most relevant:
| Agent Mode | Protection on the device | Typical use |
|---|---|---|
Endpoint | complete Sophos Endpoint protection without XDR functions | Sophos is the primary protection product |
XDR | complete Endpoint protection plus XDR functions | investigation and extended telemetry are required |
XDR Sensor | XDR detection without Sophos anti-malware protection | a supported third-party product remains responsible for protection |
Important:
XDR Sensoris not the successor to Endpoint Standard and is not reduced antivirus protection. This mode does not itself protect the device against malware.
Check the current software scope
Under My Environment > Computers & Servers, Agent mode and Agent mode status show the scope assigned to an existing device and whether a change is pending. Values such as Product unassigned or Upgrade available are assessed operationally before software is added.
For a new computer, start under My Environment > Installers. Download Complete Windows Installer uses the complete scope available under the licence. Choose Components deliberately limits the selection. The options shown depend on the tenant and its licences; an old product comparison table is not authoritative.
The installer is bound to the tenant. It must not be made public and should be removed from general shares after the rollout. If a copy has been distributed without control, previously downloaded installers can be invalidated in Sophos Fusion.
Do not reinstall existing devices unnecessarily
The software scope is normally changed through Manage Software. The device must be online and able to process the change during the next update. Afterwards, check local components, Agent Mode, effective policies and Health State again.
Processing usually completes within an hour once the device is online and updates. Adding or upgrading to full Sophos protection can remove detected third-party protection, so this step is a planned migration rather than a harmless licence correction.
Reinstallation is not the standard approach merely because a licence name has changed. It increases the risk of competing-protection, Tamper Protection, registration and restart problems without automatically explaining an incorrect Agent Mode.
Which article should you read next?
The complete current installation process, including pilot, installer options, command line and acceptance checks, is documented in Install Sophos Fusion Intercept X on Windows. Manage Sophos Endpoint agent mode and software explains how to add or remove components later. For an automated rollout, see Deploy Sophos Endpoint on Windows from the command line.