Sophos Fusion Admin: Transition from Sophos Central

Sophos Fusion is the current name of the platform formerly called Sophos Central. Distinguish two changes: the transition of portal names and access, and the gradual upgrade of the EDR, XDR and MDR solutions. A Fusion logo alone does not confirm that a particular tenant has received the product upgrade. The access transition itself does not recreate tenants, devices, policies, roles or technical endpoints. After the product upgrade, however, specific integration work may be necessary.

This runbook covers the local access transition and tenant-specific operational checks. For the steps to create or reauthorise connections, see Set up MDR and XDR integrations.

Product upgrade: check the tenant and operational impact

Checked on 11 October 2026: the September rollout information describes a transition already underway over several months, not a completed migration of all customers. Sophos controls the upgrade; customers cannot choose their own date. A console notification appears approximately one week beforehand. Another notification with a short tour follows completion. Document the announcement, completion and functions actually accessible for the affected tenant rather than inferring its state from a newsletter or portal name.

For MSP-managed tenants, Sophos specifies a later start from the fourth calendar quarter of 2026. Tenants belonging to the same MSP are to be upgraded together so that the partner operates on a consistent platform. Even on 11 October, this timing does not mean that all MSP tenants have migrated. Until the actual upgrade, the previous solution remains authoritative; clarify the customer’s state with the partner team if the announcement is unclear.

The product upgrade is automatic. It requires neither agent redeployment nor a licence change. It does not, however, replace the following operational work:

1. After completion, check existing Microsoft 365 Response Actions. The connection or its credentials must be set up again or reauthorised in the new Security Operations. A data integration that continues running does not prove that every response action works.
2. If using Sophos Firewall, open a Case and check whether firewall response actions are offered. Create a Sophos Firewall (Actions) connection only if they are missing. Both integration tasks are described in the runbook linked above.
3. For XDR automations, inventory read queries and write workflows separately, along with their APIs. The API addendum dated 9 October 2026 is a later change, not a component whose availability may be assumed at the September launch. The integration runbook explains the Classic/GraphQL boundary.
4. Inventory existing SVA Syslog collectors and any NDR workloads. An automatically preprovisioned XDR Data Collector is not yet deployed. For addressing decisions, deployment, cutover and rollback, follow Migrate SVA Log Collectors to XDR Data Collectors.

Update MDR names and reporting

The former tiers Sophos MDR Essentials and Sophos MDR Complete are now named Sophos MDR and Sophos MDR Plus respectively. The product remains Sophos XDR; Sophos XDR Powered by Secureworks identifies the enhanced solution during the transition. A new name is not a reason to change the contract or service tier without authorisation.

When the MDR account is upgraded, the previous automatic delivery of weekly and monthly MDR reports stops. Agree with report recipients who will use the MDR Dashboard during the transition, select the required period and export a PDF for existing reporting obligations. The dashboard offers flexible time ranges and customisable views. Verify an export for a known period and document where it is stored; missing automatic reports after the upgrade do not by themselves prove that protection has failed.

New self-service report creation was planned for later in 2026. This does not confirm availability today or working automatic delivery. Only a reporting function available and verified in your tenant may replace the agreed interim process.

Customers also using Sophos Managed Risk do not receive a changed Managed Risk service through this upgrade. The Case format and access change: Managed Risk Cases are accessible under Security Operations > Cases. After upgrading, open an expected Managed Risk Case and verify access in the correct tenant. This note applies only to customers with an existing Managed Risk service and creates no new service entitlement.

Do not equate optional extensions with the upgrade

Sophos AI Defense has been generally available since 13 October 2026 and is a paid add-on for qualifying EDR, XDR and MDR customers. Sophos also lists Sophos EDR Endpoint Protection as a prerequisite. The earlier EAP phase and the Q4 target at that time are now historical context, not the current availability status. General release does not, however, prove contractual entitlement or enablement in your tenant. Eligible Taegis customers can buy at GA without waiting for their Fusion migration; this purchase exception does not remove the documented technical setup prerequisite. AI Defense is not the AI Assistant or AI Search for XDR investigations. Do not make basic operations dependent on this add-on.

The documented setup still requires a Fusion account upgraded to the new platform with Security Operations. The wizard offers Sophos Endpoint, Sophos Firewall and Sophos Linux Server. The broader list of DNS Protection, Protected Browser and Sophos Data Lake in the product overview is not the same sensor selection list. Endpoint requires data uploads, TLS decryption, QUIC blocking, and Web Control and Application Control settings. Firewall requires group management and web policy logging; firewalls outside group management do not receive AI Defense enforcement rules. Linux Server requires Network Data uploads to the Data Lake. Selecting a sensor alone does not confirm effective protection.

AI Defense provides visibility, application access policies and reporting. The Base Policy applies to everyone in the organisation; an existing Base Policy remains unchanged during onboarding. For additional policies, Save saves without enabling, while Save & Enable enables immediately with the highest priority. Scope, rules and order must be checked before approval. Despite broader wording in the GA press communications, the later partner information classifies prompt inspection and protection as roadmap capabilities; they must not be planned as guaranteed current protection. Sophos AI Defense: Discover and control AI usage explains the full procedure, including sensor requirements, a limited pilot, validation and rollback.

If you previously used Cloud Optix, check a separate gap: its End of Life on 30 September 2026 is already in the past. New cloud telemetry connections are not created automatically by the product upgrade and do not replace CSPM functions. The integration runbook explains this distinction and the inventory checks now required.

Distinguish visible names and portal types

A different interface appears depending on the role and account type:

The three names refer to different management contexts and are not interchangeable. Which customers, sub-estates, or products are visible still depends on the account, role, and permissions. For detailed guidance on navigating a customer tenant, see Commission a Sophos Fusion tenant securely; Sophos portals at a glance explains the different portal types.

Prepare for the transition

1. Document the affected account type, tenant, data region, and admin role in use.
2. Confirm that login works in a supported, up-to-date desktop browser. Do not change authentication, the role, or the identity provider at the same time.
3. Record local references to the previous portal entry point: browser bookmarks, the password manager entry, internal documentation and start pages, and, if applicable, proxy or web filter rules and Conditional Access target definitions.
4. Inventory technical references separately: API hosts, redirect URIs, OIDC callbacks, webhooks, self-service links, scripts, and hard-coded product endpoints.
5. Have a test account with the admin role intended for operations ready for the acceptance test. If the Enterprise or Partner portal is also used, a corresponding test account is required for each portal type in use. Also have a second authorised admin and a private browser window ready.

MFA, passkeys, and recovery are not reconfigured in this runbook. For those topics, see Secure Sophos Fusion login with MFA, passkeys, and an IdP. Changes to Entra ID, Conditional Access, or OIDC follow the separate instructions for Microsoft Entra ID or OpenID Connect and Okta, respectively.

Update the login entry point and local references

The current user-facing entry point is:

➜ Open Sophos Fusion

1. Open https://fusion.sophos.com directly in a private browser window.
2. Complete the normal login process and verify the tenant, account type, and role.
3. Update the browser bookmark and the portal link in the internal admin documentation to https://fusion.sophos.com only after a successful test.
4. In the password manager, only add or update the login URI or its association for this portal entry point. Do not move credentials, passkeys, or stored technical URLs indiscriminately.
5. If a proxy, DNS security service, or web filter in use blocks the new host, allow the destination host actually recorded in the logs with the narrowest scope required, then test again. Do not create unsubstantiated wildcard exceptions for *.sophos.com or entire categories, and do not disable TLS inspection indiscriminately.
6. If Conditional Access is configured for the login flow, review the actual sign-in events. A new hostname does not justify either a broad exception or a change to user, device, location, or MFA conditions.

When fusion.sophos.com is opened, the browser may be redirected through legacy-compatible Central infrastructure. Observed hosts or paths containing central.sophos.com do not indicate a rollback or prove that the tenant is incorrect. What matters is a trusted Sophos destination, the expected login, and the correct management context.

Leave technical Central identifiers unchanged

The visible renaming is not a technical search-and-replace operation. The following values remain exactly unchanged unless the relevant integration or documentation explicitly specifies a new value:

• Sophos documentation paths containing /central/;
• existing Sophos Central API names, API hosts, and base URLs;
• configured redirect URIs and callback values, for example https://federation.sophos.com/login/callback;
• the technically required, legacy-compatible self-service entry point https://central.sophos.com/manage/self-service;
• webhooks, script variables, secrets, certificate references, and other technical endpoints with central in their names;
• stable internal slugs, search terms, and historical records.

Such values may be protocol contracts or subject to exact matching. Editorial renaming can disrupt SSO, API clients, or user access. Handle licence tasks instead in Activate, verify, and renew Sophos Fusion licences.

Validation

The transition is complete when the following applicable items have been checked with a test account assigned the admin role intended for operations. Repeat the test for each additional portal type in use with the test account intended for that portal type:

• https://fusion.sophos.com opens the expected Sophos login without a certificate or filtering warning.
• Configured MFA and, if used, the federated login flow continue to work unchanged; the expected role and correct tenant are visible.
• The customer, Enterprise, or Partner context displays the appropriate visible name.
• My Environment, Global Settings, the profile, and Sophos Help are accessible as permitted by the role.
• An existing API or automation smoke test completes without changing the host or secret.
• If configured or used, the SSO callback, self-service link, and other technical Central endpoints continue to work unchanged.
• If a proxy, DNS security service, web filter, IdP, or Conditional Access is used, its logs show no newly blocked requests or unexpected exceptions.
• Old internal instructions point to the Fusion URL for admin access but retain exact technical Central values.

Troubleshooting

Redirect to a Central host

Do not switch back to what appears to be an old state. First verify the certificate, complete redirect chain, destination tenant, and successful login. Legacy names in the runtime infrastructure may still be correct.

Blocked or blank page

Test in a browser without extensions or in a private browser window, and record the time, source URL, final host, and error message. Then check the logs of the proxy, DNS, web filtering, and TLS inspection systems in use for the specific host being blocked. Make only the change supported by this evidence; do not allow wildcards as a precaution.

If multiple independent logins or tenants are affected at the same time, use Sophos Status to check for a possible wider service outage. The status page is a diagnostic indicator; continue to make local changes only on the basis of verified causes.

Login or Conditional Access errors

Compare the Sophos login events chronologically with those from the IdP, if one is used. Do not recreate an IdP app, callback URL, or Conditional Access policy solely because of the new visible name. For diagnosis and rollback, follow only the SSO runbook linked above for the affected login flow; retain the tested fallback admin.

Missing menu item

First check the account type and role. Then look under My Environment, use the gear icon for Global Settings, and check the profile and Sophos Help. A missing menu item may reflect a role or licence limitation; it does not prove that the renaming failed.

Missing tenants, products, or customers

Log out, start again in a private browser window with the intended identity, and verify the account type and tenant. Do not create replacement tenants, trials, or new partner assignments as a fix.

If access remains disrupted after these checks, collect the affected time window with time zone, affected identity, tenant or Customer ID, browser, source and destination hosts, error message, and sanitised screenshots. Then escalate by following Open a Sophos support ticket with Support Assistant.

Local rollback

The vendor-side renaming from Sophos Central to Sophos Fusion cannot be rolled back by the customer. Only the local adjustments made as part of this change may be reverted:

• bookmarks and internal documentation links,
• login URI associations in the password manager,
• specific proxy, DNS, or web filter rules.

Before reverting, retrieve the previous value from the change documentation and then test access again. IdP or Conditional Access adjustments are not part of this local rollback; revert them only according to the SSO runbook linked above for the affected login flow and its documented rollback procedure. The old Central hostname is not a guaranteed rollback path. Do not modify API hosts, callbacks, self-service URLs, or other technical values that were intentionally left unchanged for this transition.