Sophos Endpoint macOS CLI and permissions
An automated macOS rollout has two separate layers: the Sophos installer registers the device and installs the selected components. MDM profiles then approve the system and privacy functions protected by Apple. A successful installer alone therefore does not mean full protection.
For a Jamf Pro rollout, see Deploy Sophos Endpoint on macOS with MDM. This article focuses on CLI parameters and technical permission checks.
Prepare the installer
On macOS Monterey 12.4 and later, do not extract the archive in Documents, Downloads or on the desktop. Sophos recommends a directory in the user’s home folder.
After extraction, the executable installer is inside the app bundle. For example, run the built-in help and an unattended installation as follows:
sudo ./Sophos\ Installer.app/Contents/MacOS/Sophos\ Installer --help
sudo ./Sophos\ Installer.app/Contents/MacOS/Sophos\ Installer --install --quiet
The installer is bound to the tenant and must be treated as a confidential deployment artefact.
Set group and tags
--devicegroup assigns a computer to a Central group or subgroup:
sudo ./Sophos\ Installer.app/Contents/MacOS/Sophos\ Installer \
--install --quiet \
--devicegroup "Workstations\Switzerland\Mac"
Spaces in the group path must be escaped correctly for the shell. If the group does not yet exist, the installer can create it. After rollout, still check whether the intended policy actually applies.
Tags can be supplied more than once:
sudo ./Sophos\ Installer.app/Contents/MacOS/Sophos\ Installer \
--install --quiet \
--tag=Country:CH \
--tag=Department:Design \
--tag=VIP
Tags help with search and operations. They do not replace a policy group while policies cannot be assigned by tag.
Products and Agent Mode
--products accepts a space-separated product selection. Documented values include antivirus, intercept, mdr, xdr, deviceEncryption and all.
For example, full protection with Anti-Virus and Intercept X uses:
sudo ./Sophos\ Installer.app/Contents/MacOS/Sophos\ Installer \
--install --quiet --products antivirus intercept
Installing only xdr does not provide full malware protection. A compatible third-party protection product must be present. XDR-only requires at least macOS 13 Ventura on Macs.
Unlicensed products are not installed. Also check Agent Mode in Central after rollout.
Proxy and Message Relay
The following options are available for an explicit proxy:
--proxyaddress <URL>
--proxyport <port>
--proxyusername <user>
--proxypassword <password>
Specify a Message Relay using its IP address and port 8190:
--messagerelays 192.0.2.10:8190 192.0.2.11:8190
The downloaded installer knows about the Update Caches and Message Relays that existed when it was generated. After changes to this infrastructure, use a current installer or specify the Relay explicitly by CLI.
Proxy passwords must not remain in readable scripts, MDM profiles or output. Prefer a Secret function in the deployment platform.
Override computer and domain names
--computernameoverride and --domainnameoverride affect the display in Sophos Central. Both options are intended for a new installation.
--computernameoverride CH-ZRH-MAC-042
--domainnameoverride corp.example
Pass the computer name to the installer without additional quotation marks. A later change can create a second device object. Use overrides only with a documented naming source.
--mcsPreferHostname reports usernames as domain\username rather than machine\username. This can reduce duplicate local users, but must fit the identity strategy.
Tenant and Registration Server
--customertoken <UUID> assigns the installation to a Central customer. --mgmtserver <URL> sets the MCS Registration Server. Both values normally come from the tenant-bound installer and must not be invented.
--bypasstaegisidcheck bypasses a mismatched Taegis Tenant ID Check. This is a targeted special case, not a standard parameter for every rollout. Before using it, determine why the tenant IDs do not match.
Control names through a plist
Alternatively, set the computer name, domain and description through:
/Library/Preferences/com.sophos.mcs-overrides.plist
CLI overrides take precedence over the file. Valid values are 1 to 256 characters long and must not contain line breaks or the characters <, >, &, ', " and /, among others.
Changing the file after installation can create a new device object in Central while the old one remains. Load the change through a restart or the following MCS restart:
sudo launchctl stop com.sophos.mcs
macOS security permissions
Depending on the version and installed components, Sophos particularly requires:
- approved System Extensions,
- approved Network Extensions and Content Filter,
- Full Disk Access,
- notification permissions,
- Web or Scan Extension permissions.
Download the current profiles from Sophos Central before the installer. Check custom profiles against the current Sophos documentation because Team IDs, Bundle IDs and Payloads can change with components.
Check permissions
The local Endpoint interface shows missing requirements under About or in Health status. Sophos also documents a Terminal check and a check for remote deployments.
For validation, compare three levels:
- MDM reports all profiles as installed.
- The local agent reports no missing Security Permission.
- Central shows Health, components and Last Active correctly.
If the state remains poor, do not blindly distribute new profiles. First identify which specific Extension or privacy approval is missing.
System Extensions can be verified in Terminal:
systemextensionsctl list
A working Sophos entry shows [activated enabled]. States such as [activated waiting for user], [waiting for approval] or [blocked] confirm a permission problem. The Sophos Team ID 2H5GFH3774 and Bundle IDs com.sophos.endpoint.networkextension and com.sophos.endpoint.scanextension are particularly relevant.
If the Allow dialogue does not appear despite an incorrect state, first use Fix It under Endpoint Self Help > Prerequisites. The Sophos-documented process of retriggering the dialogue through Finder, Bin, Put Back and restart is a repair step for this specific state. It requires Tamper Protection to be disabled temporarily and must not be automated as a general permissions routine.
Update errors on macOS
Missing permissions can appear as an update or Health problem. Since Sophos Endpoint for macOS 2024.4, Sophos Updater service health turns red if the Updater lacks Full Disk Access. This can happen before an update actually fails. On devices without MDM, grant the permission through Endpoint Self Help > Prerequisites > Allow Full Disk Access; manually searching for the Updater in macOS settings is unreliable.
For an error, use local Events, Self Help and SDU. Also check MDM profile status, system time, proxy, root certificates and Sophos domains.