Sophos Endpoint macOS CLI and permissions
An automated macOS rollout has two separate layers: the Sophos installer registers the device and installs the selected components. MDM profiles then approve the system and privacy functions protected by Apple. A successful installer alone therefore does not mean full protection.
For a Jamf Pro rollout, see Deploy Sophos Endpoint on macOS with MDM. This article focuses on CLI parameters and technical permission checks.
Prepare the installer
On macOS Monterey 12.4 and later, do not extract the archive in Documents, Downloads or on the desktop. Sophos recommends a directory in the user’s home folder.
Run Terminal from the directory containing Sophos Installer.app; sudo requires a local administrator. Sophos documents this unattended Anti-Virus and Intercept X installation:
sudo ./Sophos\ Installer.app/Contents/MacOS/Sophos\ Installer --products antivirus intercept --quiet
The installer is bound to the tenant and must be treated as a confidential deployment artefact. The command installs and registers licensed components. Pilot it first, then verify the device, products, Health and effective policy in Central. For rollback, use Sophos’s documented uninstaller rather than deleting individual files. If installation still fails, preserve the installer logs and an SDU archive for Sophos Support.
Set group and tags
--devicegroup assigns a computer to a Central group or subgroup:
sudo ./Sophos\ Installer.app/Contents/MacOS/Sophos\ Installer \
--install --quiet \
--devicegroup "Workstations\Switzerland\Mac"
Spaces in the group path must be escaped correctly for the shell. If the group does not yet exist, the installer can create it. After rollout, still check whether the intended policy actually applies.
Tags can be supplied more than once:
sudo ./Sophos\ Installer.app/Contents/MacOS/Sophos\ Installer \
--install --quiet \
--tag=Country:CH \
--tag=Department:Design \
--tag=VIP
Tags help with search and operations. They do not replace a policy group while policies cannot be assigned by tag.
Products and Agent Mode
--products accepts a space-separated product selection. Documented values include antivirus, intercept, mdr, xdr, deviceEncryption and all.
For example, full protection with Anti-Virus and Intercept X uses:
sudo ./Sophos\ Installer.app/Contents/MacOS/Sophos\ Installer \
--install --quiet --products antivirus intercept
Installing only xdr does not provide full malware protection. A compatible third-party protection product must be present. XDR-only requires at least macOS 13 Ventura on Macs.
Unlicensed products are not installed. Also check Agent Mode in Central after rollout.
Proxy and Message Relay
The following options are available for an explicit proxy:
--proxyaddress <URL>
--proxyport <port>
--proxyusername <user>
--proxypassword <password>
Specify a Message Relay using its IP address and port 8190:
--messagerelays 192.0.2.10:8190 192.0.2.11:8190
The downloaded installer knows about the Update Caches and Message Relays that existed when it was generated. After changes to this infrastructure, use a current installer or specify the Relay explicitly by CLI.
Proxy passwords must not remain in readable scripts, MDM profiles or output. Prefer a Secret function in the deployment platform.
Override computer and domain names
--computernameoverride and --domainnameoverride affect the display in Sophos Central. Both options are intended for a new installation.
--computernameoverride CH-ZRH-MAC-042
--domainnameoverride corp.example
Pass the computer name to the installer without additional quotation marks. A later change can create a second device object. Use overrides only with a documented naming source.
--mcsPreferHostname reports usernames as domain\username rather than machine\username. This can reduce duplicate local users, but must fit the identity strategy.
Tenant and Registration Server
--customertoken <UUID> assigns the installation to a Central customer. --mgmtserver <URL> sets the MCS Registration Server. Both values normally come from the tenant-bound installer and must not be invented.
--bypasstaegisidcheck bypasses a mismatched Taegis Tenant ID Check. This is a targeted special case, not a standard parameter for every rollout. Before using it, determine why the tenant IDs do not match.
Control names through a plist
Alternatively, set the computer name, domain and description through:
/Library/Preferences/com.sophos.mcs-overrides.plist
CLI overrides take precedence over the file. Valid values are 1 to 256 characters long and must not contain line breaks or the characters <, >, &, ', " and /, among others.
Changing the file after installation can create a new device object in Central while the old one remains. Load the change through a restart or the following MCS restart:
sudo launchctl stop com.sophos.mcs
macOS security permissions
Depending on the version and installed components, Sophos particularly requires:
- approved System Extensions,
- approved Network Extensions and Content Filter,
- Full Disk Access,
- notification permissions,
- Web or Scan Extension permissions.
Download the current profiles from Sophos Central before the installer. Check custom profiles against the current Sophos documentation because Team IDs, Bundle IDs and Payloads can change with components.
Check permissions
The local Endpoint interface shows missing requirements under About or in Health status. Sophos also documents a Terminal check and a check for remote deployments.
For validation, compare three levels:
- MDM reports all profiles as installed.
- The local agent reports no missing Security Permission.
- Central shows Health, components and Last Active correctly.
If the state remains poor, do not blindly distribute new profiles. First identify which specific Extension or privacy approval is missing.
For the detailed read-only check, an administrator must first enable Terminal under System Settings > Privacy & Security > Full Disk Access, then run:
sudo sqlite3 /Library/Application\ Support/com.apple.TCC/TCC.db 'select * from access' | grep -i sophos
The command reads Apple’s TCC database and filters Sophos entries; it changes no permission. Results vary by license and installed products. Disable Full Disk Access for Terminal again afterwards. For remote deployments, copy the overrides for inspection with sudo cp /Library/Application\ Support/com.apple.TCC/MDMOverrides.plist ~/Desktop/; this creates a copy without changing active policy. Delete it in Finder after analysis. If Self Help remains red, compare MDM payloads with installed components and escalate with an SDU archive rather than editing the TCC database.
Update errors on macOS
Missing permissions can appear as an update or Health problem. Since Sophos Endpoint for macOS 2024.4 (10.9.5), Sophos Updater service health turns red if the Updater lacks Full Disk Access, even before an update fails. An administrator can run this official read-only check in Terminal:
sudo log show --predicate "subsystem == 'com.sophos.macendpoint'" --last 1d | grep -i 'Error renaming Installer directory'
Output confirms the permission issue. Without MDM, enable SophosUpdater.app under System Settings > Privacy & Security > Full Disk Access; if absent, add /Library/Sophos Anti-Virus/SophosUpdater.app with the plus button. With MDM, update to the latest Sophos profiles. Recheck Self Help, updater Health, Agent Version, Last Agent Update and Events. If the condition remains after a full check cycle, collect SDU and escalate to Sophos Support. Remove Full Disk Access granted only to Terminal for diagnosis; SophosUpdater still needs its permission.
For an error, use local Events, Self Help and SDU. Also check MDM profile status, system time, proxy, root certificates and Sophos domains.