Sophos Email: manage licenses, usage and lifecycle

Sophos Email licensing isn’t based simply on every address object in the directory. It counts individual and shared mailboxes for which Sophos processed at least one message during the previous 30 days. Aliases, distribution lists and public folders don’t require their own licenses.

Quick path: choose the edition and add-ons according to the required features, inventory individual and shared mailboxes, then reconcile them with the entitlement under Reports > Email Security > License Usage Summary. Resolve an overage or buy additional capacity early. Before a trial or subscription ends, make a firm renewal or cleanup decision; never rely on a possible temporary license.

Choose the right license scope

Sophos offers two base editions:

Sophos Email includes core email security and protection features.
Sophos Email Plus includes those features plus additional advanced protection and reporting capabilities.

Record the exact features needed before ordering and have a Sophos partner or sales representative confirm their mapping to the current edition. This avoids inferring an edition from a feature name if the offering changes. Sophos Email is intended for business customers, including commercial, educational and government organizations. It is also available through a Managed Service Provider as a monthly Flex offering, with the same licensing rules.

Activate and manage licenses in Sophos Fusion (formerly Sophos Central) through Profile icon > Licensing. At minimum, an order needs the edition, term and expected number of protected individual and shared mailboxes.

Plan add-ons separately

Portal Encryption

Portal Encryption adds portal-based encryption to Sophos Email. The encrypted message is stored in the web portal; the recipient signs in to read it and can reply from the portal. The add-on also enables custom branding for encryption messages and the portal.

The following boundaries apply:

You can start a free add-on trial when you already have a purchased Sophos Email license.
You can’t trial Sophos Email and the Portal Encryption Add-on at the same time.
The number of Portal Encryption licenses can’t exceed the number of Sophos Email licenses.
Users are assigned through the Secure Message policy.
Custom branding for encryption messages and the portal requires the add-on.

DMARC Manager

DMARC Manager is included with Sophos Email Plus and is available separately as an add-on for customers with Sophos Email as well as customers licensed for the Sophos Email Monitoring System (EMS). Sophos Email and EMS remain separate products. The add-on’s availability for EMS does not mean that a Sophos Email license provides an EMS base entitlement or vice versa.

DMARC Manager provides summary and detailed reports on DMARC authentication and compliance for outbound email. For license reconciliation, record the existing base product and the DMARC Manager entitlement separately. If the expected entitlement is missing, clarify the order with the Sophos partner or sales representative. If the entitlement is present but reports still fail to appear after successful setup, use the appropriate DMARC Manager or EMS setup and troubleshooting guide, or contact Sophos Support.

How Sophos calculates usage

The License Usage Summary report counts each mailbox for which Sophos Email processed at least one email in the last 30 days. Usage is updated every four hours. This creates four important boundaries:

Individual users and shared mailboxes require a license when protected and processed within the 30-day window.
An alias, distribution list or public folder doesn’t require its own license.
A mailbox that exists but hasn’t been processed during the last 30 days doesn’t contribute to current usage. It can count again as soon as Sophos processes a message for it.
When a mailbox is deleted from Sophos Email, Sophos removes it from the calculation immediately; the reduced value appears within the four-hour update cycle.

The Email report combines unique usage for Sophos Email and Sophos Phish Threat. It doesn’t separate the two products into two consumption figures. If both are in use, don’t interpret the displayed total as the Sophos Email mailbox count alone or simply add the two inventories.

Reconcile usage with entitlement

Use this monthly reconciliation process:

Record entitlement: Note the edition, term, licensed quantity, and Portal Encryption and DMARC Manager scope from the contract or partner confirmation.
Build the expected inventory: Record protected individual and shared mailboxes from the authoritative mailbox source. Mark aliases, distribution lists and public folders separately instead of counting them as licensed mailboxes.
Open the report: Under Reports > Email Security > License Usage Summary, check the value and any overage indication.
Explain differences: Account for the rolling 30-day window, four-hour update cycle, deleted mailboxes and combined unique Email/Phish Threat usage.
Record the decision: Remove an unneeded mailbox only after checking its business and technical dependencies; otherwise obtain sufficient licenses.

A directory snapshot and the report don’t have to match: the directory shows existing objects, while the report shows unique usage actually processed in a rolling period. Capacity planning should therefore also account for growth and the reactivation of existing mailboxes.

Handle an overage

When license usage is exceeded, Sophos flags the account and sends a Sophos Central alert. All mailboxes remain fully protected initially. In License Usage Summary, you can review mailboxes shown as unlicensed because the license limit has been exceeded.

Don’t ignore the alert. First check the calculation model and inventory, remove only mailboxes that are genuinely no longer needed, or purchase additional licenses through sales. Without action, Sophos will ask you to reduce the number of users or pay for the additional licenses. The exact outcome may vary with license type and expiration date.

Close a trial in a controlled way

The free Sophos Email trial lasts 30 days and provides access to all Sophos Email features. Sophos Email is part of the standard Sophos Central trial license and is included automatically when a trial is requested. Before starting, record the start and end dates, expected mailbox quantity, target edition, and owner for purchase or cleanup.

After the trial, Sophos may continue protection with a short-term temporary license for up to 30 more days. This is neither guaranteed nor necessarily free; Sophos reserves the right to charge a license fee. A trial extension isn’t guaranteed either. If the trial quota is exceeded, Sophos flags the account for licensing at the end of the month and requests a reduction or payment for the additional licenses.

Secure expiration and cleanup

Without renewal, protection ends and Sophos revokes access to Sophos Email after any temporary period it may grant. If you renew during an approved temporary period, the new license starts retrospectively on the day the previous license ended. Plan renewal or cleanup before the contractual end date and contact the Sophos partner or sales representative immediately if the license has already expired.

Cleanup depends on the domain mode:

Gateway: You must manually change the MX records so email no longer routes to Sophos. If they keep pointing to Sophos, messages are rejected after protection ends. Test the new or restored destination path before Sophos access ends.
Mailflow: Sophos triggers an automatic cleanup of the Microsoft 365 configuration. You must still explicitly verify in Microsoft 365 that the connectors and Mailflow rules have been removed. “Automatic” doesn’t replace the final check.

An expiration date alone isn’t a cutover plan. The change record should combine owners, current mail path, approved target path, test messages and escalation contact. Change routing only through a documented provider-specific procedure; this licensing guide doesn’t invent connector or DNS steps.

Troubleshoot differences systematically

Report higher than expected: Check whether mail was still processed for now-inactive mailboxes during the last 30 days and whether Phish Threat contributes to the combined unique usage. Don’t treat aliases, distribution lists or public folders as separate licenses.
Deleted mailbox still visible: Record the deletion time, then check again after the next four-hour cycle. If the value still doesn’t change, document the report data and affected mailbox for Sophos Support.
Report lower than the inventory: Check which mailboxes were actually processed in the rolling 30-day window. A low current value doesn’t guarantee sufficient capacity when mail traffic resumes.
Alert despite an apparently sufficient quantity: Compare contract quantity and edition with Licensing, then check the combined Email/Phish Threat report. Don’t delete protection objects merely to make the report look right.
End date unclear: Obtain written confirmation from the partner or sales representative. Until then, treat neither a possible 30-day temporary period nor automatic Mailflow cleanup as guaranteed.