Check and safely update Sophos Connect Client

The current Sophos guide describes an upgrade on Windows and macOS as downloading and installing the new package from the VPN Portal or the administrator; it does not require prior uninstallation in all cases. This does not confirm that every package can update every existing installation in place. This article retains the controlled remove-and-reinstall approach for an explicitly approved reinstall or rollback. Before making changes, establish the appropriate method for the current and target versions and test it in a pilot; profiles, installation packages, and the rollback path must be ready.

Find the installed version in Sophos Connect under three dots > About. The Windows and macOS guides cover first-time installation; this guide covers the version decision and controlled transition.

If you’re still choosing between IPsec, SSL VPN, and other remote-access methods, start with the remote-access comparison before selecting a client rollout target.

Choose the target version

Don’t automatically deploy the newest package widely. First compare the version changes explained below, supported operating systems, and VPN functions actually in use with your own environment. The editorial review on 7 September 2026 produced the following dated snapshot:

• Windows: Sophos Connect 2.5 MR1, released 18 June 2026.
• macOS: Sophos Connect 2.0 MR1, released 21 May 2026.

Update on 9 October 2026: The release notes list Sophos Connect 2.1 for macOS, released on 6 October 2026, with native ARM support, .pro provisioning and Microsoft Entra ID SSO for IPsec and SSL VPN. The 7 September snapshot remains historical. A documented release proves neither which package is actually available in your own portal nor that a device test has passed; no additional GA or rollout approval is inferred from it.

These versions are a review snapshot, not an indefinite approval. Before a new rollout, compare the version matrix and the fixes described with the version of the package actually available; the responsible IT team confirms its current platform support and suitability for the required VPN functions. Test a newer release in a pilot first. Keep an older release as the target only when it is still supported for the existing platform and there is a documented reason not to use the newer one. Don’t infer client-specific end-of-life dates from Sophos’s general product lifecycle page.

The following boundaries matter for the decision:

Sophos Connect isn’t a client for iOS or Android. If a platform or function falls outside these boundaries, don’t deploy experimentally; define a migration path first.

The reviewed releases also contain fixes that can affect the decision. Windows 2.5 MR1 fixes, among other issues, startup for additional users (NCL-2570), incorrect SSO status after an internet outage (NCL-2783), inconsistent OTP prompts on reconnect (NCL-2992), and SSL VPN provisioning when certificates contain special characters (NCL-2795). macOS 2.0 MR1 includes fixes for SSL VPN DNS and restores saved credentials. An issue ID still doesn’t replace a pilot with your own profile.

Prepare the update and rollback

Record the following for each platform and user group before the maintenance window:

• installed client and operating system version;
• IPsec or SSL VPN and profile source (.scx, .ovpn, or .pro); a .tgb file, by contrast, is an export for third-party IPsec clients, not a Sophos Connect profile;
• local, AD, RADIUS, or Entra ID SSO authentication;
• MFA and reconnect behaviour;
• profile dependencies such as gateway, certificate, DNS, VPN pool, and permitted networks.

Also retain the target package, the previously approved internal package, and the original profile sources in software distribution. A screenshot of a profile name isn’t a backup. A rollback requires the actual export that was used or a reproducible provisioning source. Store profiles containing certificates or private keys securely and only for the intended user identity.

Admins can obtain the installer under Remote access VPN > IPsec or Remote access VPN > SSL VPN with Download client; users can get it from the VPN Portal. Backup & Firmware > Pattern updates can refresh the download package on the firewall, but it doesn’t update installed endpoints. Verify the package’s source, platform, and version before deployment, and clearly block or label old packages.

Run a pilot

Include at least one device for every production combination. Don’t select only IT admins; include one to three typical users. Where applicable, cover Windows x64, Windows ARM, macOS with IPsec, macOS with SSL VPN, Entra SSO, and OTP/MFA reconnect separately. On the Mac, check 2.0/Rosetta and 2.1/native ARM, the macOS version actually in use, and direct profiles and provisioning separately. For Entra SSO from 2.1, browser mode, required fallback and the return to the client are part of the macOS SSO pilot. Resolve a compliance error or escalate it to IT rather than bypassing it by weakening Conditional Access.

Document a baseline test on every pilot device before the upgrade: sign-in, assigned VPN address, internal DNS resolution, access to a representative internal destination, split- or full-tunnel behaviour, and reconnect after a network change. Repeat exactly the same tests afterwards. This separates a client regression from a firewall, routing, or profile problem that already existed.

Start a phased broad deployment only after all expected combinations pass and the helpdesk knows the target version and rollback. One successful Windows test doesn’t approve macOS.

Remove and reinstall the client

Disconnect the active VPN before uninstalling. If the client is the device’s only remote administration path, arrange a local maintenance window or a second administration path: VPN access is interrupted during removal and installation.

Windows

1. Under Control Panel > Programs > Uninstall a program, select Sophos Connect and start Uninstall.
2. Wait for removal to finish. Don’t postpone a requested restart.
3. Install the approved Windows target package with administrator rights.
4. Open Sophos Connect and confirm the planned version under three dots > About.
5. Check the existing profile or reimport it from the retained source, then run the pilot test.

Don’t roll Windows ARM back to a version before 2.5. Don’t update a 32-bit Windows endpoint to 2.5; it needs a platform migration plan.

macOS

If Sophos Endpoint is installed, do not turn off its Tamper Protection as a routine step before removal. The current uninstall guide no longer lists this as a prerequisite; however, the troubleshooting guidance still describes Sophos Connect processes being blocked by Endpoint Tamper Protection and recommends a restart. If you encounter these symptoms, retain the logs, restart during the maintenance window, and check the state again. If removal remains blocked, consult IT or Sophos about the specific Endpoint/client combination. Change protection temporarily only with explicit approval for this case; re-enabling it is then part of completing the procedure, even if the attempt fails. For an approved removal, open Terminal and run with administrator privileges:

sudo /Library/Sophos\ Connect/uninstall.sh

The expected confirmation is Sophos Connect has been uninstalled. Then:

1. Restart the Mac if requested.
2. Install the approved macOS package and approve the required system prompts.
3. Open Sophos Connect and check the version under three dots > About.
4. Provide the profile from the retained source and repeat the pilot checks.
5. If Tamper Protection was explicitly disabled for this procedure, turn it back on and verify that it is active both on the endpoint and in the management console; do this even if reinstallation fails.

A version before 2.0 isn’t a valid rollback for SSL VPN on macOS. After moving to 2.0 MR1, reimport the configuration if users need the restored saved-credentials option. Rolling back to macOS client 2.0 does not retain native ARM execution, .pro provisioning or Entra ID SSO. If these 2.1 features are required, 2.0 is not an equivalent rollback option; approve and test a supported alternative in advance.

Handle profile changes separately

A client upgrade doesn’t automatically update every VPN configuration. For manually distributed IPsec .scx files, export and distribute a new file after changes to advanced settings. On Windows with a compatible client and on macOS from 2.1, an imported .pro file retrieves configurations through the VPN Portal. After changing the port or protocol under Remote access VPN > SSL VPN > SSL VPN global settings, the user clicks the profile’s gear icon and Update policy. On macOS 2.0, direct imports and manual profile maintenance remain necessary. Provisioning file configuration belongs in Sophos Connect Provisioning.

Documented for SFOS 22: An imported SSL VPN profile is bound to the user identity, domain, and authentication method used during import. When moving, for example, from AD to Entra ID SSO or between domains, a separate .pro or .ovpn configuration must be imported; reusing the same imported profile can lead to Login failed. Wrong fingerprint of certificate. An .ovpn file contains user-specific certificates and private keys. A .pro file, by contrast, is not inherently user-specific: the SSL VPN configuration and certificates are generated only during import and associated with the identity and authentication method used. This restriction documented for SFOS 22 applies to SSL VPN, not IPsec .scx profiles.

This behaviour has not been verified for SFOS 23. The corresponding guide does not contain the section on profile binding and this error message. This proves neither that the binding has been removed nor that it continues unchanged. When changing domain or authentication method, a separate SSL profile import from an IT-confirmed, trusted source is therefore recommended as a precaution; this is not a confirmed SFOS 23 requirement. First confirm the intended user identity, domain, authentication method, and target server with IT and, if needed, obtain a current .ovpn file from the confirmed VPN Portal or use the approved .pro source. Then test the client/profile pair in a pilot. If the fingerprint message appears, stop deployment and record the client and SFOS versions, intended identity, domain, authentication method, and the entry under Events for IT or Sophos. The message alone proves neither an expired certificate nor a signature or trust-chain error. Do not bypass certificate checks.

Make firewall-side changes with the guides for Sophos Connect with IPsec, SSL VPN remote access, or Entra ID SSO. Then return here and test the updated client/profile pair in the pilot.

Validate and approve the rollout

A displayed target version and a green connection status aren’t enough. Record these results for every pilot combination:

• target version under About is correct;
• sign-in and MFA or SSO behave as expected;
• the correct VPN address is assigned;
• internal DNS names and a representative destination work;
• the matching VPN zone rule appears in Log Viewer;
• split or full tunnel matches the intended design;
• reconnect after a network change, sign-out, and sign-in work.

If a test fails, stop deployment for that combination. First check the target version, OS boundary, and profile actually loaded. Then record the time, visible message, and matching entry under Events. Sophos Connect Client troubleshooting provides the systematic diagnosis for connection, DNS, authentication, policy, and service errors; this update guide deliberately doesn’t duplicate that symptom catalogue.

Roll back and escalate

A rollback temporarily restores service. It isn’t a permanent answer to an outdated or vulnerable client.

1. Stop broad deployment and identify the affected platform/profile combination.
2. Uninstall the failed client through the same documented path.
3. Install only the previously approved package suitable for the platform.
4. Reimport the retained profile source.
5. Retest version, sign-in, VPN address, DNS, an internal destination, Log Viewer, and reconnect.
6. Record the outcome and start another pilot only after the cause is understood.

If the rollback also fails, open three dots > About > Generate Technical Support Report. The report contains VPN configurations, connection events, provisioning details, SSO authentication information, browser details, and endpoint information. Share it only with authorized recipients through a controlled transfer channel in accordance with your organization’s privacy rules. Include target and previous version, OS, profile type, timestamp, visible error, and rollback result in the escalation; never put passwords, OTPs, or private keys in the ticket text.