Skip to content
Avanet

Sophos Protected Browser: Create application groups and classify policy objects

Sophos Protected Browser provides application groups, site lists, device postures and web categories under My Products > Protected Browser > Policy objects. The steps below use English UI labels. Sophos documents complete workflows for application groups, site lists and device postures; the web-category guide still contains a contradiction.

Clarify prerequisites, licence and role

The Sophos procedure pages linked here specify neither the required licence entitlement nor a particular minimum role. A visible menu path or the visible Add object action does not confirm a licence entitlement either. Before making a change, therefore, have the entitlement checked by the team responsible for licensing.

Assign Sophos Fusion administration roles correctly provides general background about policy permissions and checking them with an administrator account. However, that article does not map these permissions to Protected Browser policy objects and therefore does not establish a minimum role for Add object. If the role or action is unclear, stop and have the product-specific permission clarified.

ZTNA is an additional prerequisite only if an application group is to contain agentless RDP or SSH applications. For this purpose, ZTNA must already be set up, the required resources must be available in ZTNA, and ZTNA gateways deployed on ESXi, Microsoft Hyper-V or Sophos Firewall must each be running the latest version for their platform.

Create an application group

An application group is suitable when several applications are to be managed together under an internet policy.

  1. Open My Products > Protected Browser > Policy objects.
  2. Click Add object and select Application group.
  3. Under Name, enter a name, and under Description, enter a description for the application group.
  4. For agentless RDP or SSH applications, expand ZTNA resources and select the required applications.
  5. For other applications, expand the appropriate Application category and select the applications.
  6. An expanded category initially displays 20 applications. Show more displays the next 20.
  7. Alternatively, search for the application name in the Search field. Then enable Show added apps only to review the selection specifically.
  8. Click Save.

According to Sophos, Add all apps currently in list is available only for Generative AI. Sophos: Add an application group.

Important: In this workflow, only agentless SSH and RDP applications appear under ZTNA resources. An agentless web application belongs in a Site list instead.

Create a site list

  1. Open My Products > Protected Browser > Policy objects.
  2. Select Add object > Site list and enter a name and description.
  3. Under Sites, enter domains, URLs or IP addresses. Confirm every item with Enter or Tab, even a single item. Use line breaks when pasting multiple items.
  4. Check the selection and click Save.

A site list can also contain agentless ZTNA web applications.

Sophos: Add a site list.

Web category: note the documented contradiction

The Sophos guide is titled Add a web category, but one step instructs you to select the Site list type under Add object. This instruction contradicts the object type stated in the title.

Do not treat this as a safe click path and do not create another object as an experiment. Stop before selecting or saving anything and clarify the current workflow with Sophos Support. The Sophos guide does not describe a safe continuation or save path for a web-category object.

Configure device posture

Select Add object > Device posture, enter a name and description, then choose Windows or macOS under OS platform. Choose whether the conditions apply to Protected Browser, the extension or both. Endpoint protection offers conditions for Sophos Endpoint, its health status, detected EPP products or absent protection, as well as skipping this check. According to Sophos, Any active EPP detected only checks whether a supported product is installed; it does not confirm active protection.

Important: The extension does not evaluate endpoint health. Health conditions apply only to the full Protected Browser. Under Full disk encryption (FDE), select the appropriate BitLocker or FileVault conditions for the operating system, or skip the encryption check. Review the conditions and finish with Save.

Sophos: Add a device posture.

Review the selection before saving

This is not a complete functional test. Sophos documents neither a success indication after saving nor a report or test of the policy’s effect. Review the application-group selection before saving as follows:

  1. Record the intended object name, object type and application selection locally.
  2. In the dialogue, review the selected applications using Show added apps only and, if necessary, Search.

Stop the selection review here, before saving. This confirms only the selection in the dialogue.

Then save

Now click Save to complete the documented creation workflow. However, Sophos gives no success indication and describes neither a check of the persistently saved values nor the effect of a policy linked later. If there is no unambiguous result after saving, do not make further changes as a supposed test; instead, clarify the verification path with Sophos Support.

Troubleshooting by symptom

A ZTNA web application is missing from the application group

Agentless ZTNA web applications belong in a Site list; use the complete workflow above.

Only 20 applications are displayed

In the expanded application category, click Show more to display the next 20 applications. Alternatively, use Search to find the required application.

The web-category dialogue does not match the guide

The documented Site list selection contradicts the title of the Sophos guide. Do not create another object as an experiment. Stop before selecting or saving anything and clarify the current UI path with Sophos Support.

Prepare changes safely

Sophos describes neither deletion nor a dependency view or restoration here. Therefore, record the intended change in a local change record before creating the object. If an existing object is to be changed, withdrawn or removed, stop before the change and clarify the current, documented workflow with Sophos Support.

Operation and recurring checks

Sophos describes no workflow here for recurring checks or measures during the operation of these policy objects. Therefore, do not use this guide as evidence for operation or decommissioning. For any further checks, you must clarify the current workflow with Sophos Support.