Understand Sophos Central Enterprise and sub-estates

Sophos Central Enterprise groups several independent Sophos Fusion (formerly Sophos Central) tenants under one Enterprise management layer. These tenants are called sub-estates. The model suits corporate groups, national organizations, legally separate entities, or sites that require their own data and administration boundary.

Sophos Central Enterprise is not the same as one large tenant with many groups. Each sub-estate has its own users, devices, policies, licenses, data region, and local administrators.

When sub-estates are appropriate

A separate sub-estate is useful when at least one real boundary exists:

• legal or organizational responsibility,
• separate data region,
• separate administrators and approvals,
• separate license or cost center,
• separate policies, reports, or audit requirements,
• acquisition with gradual integration.

Different departments alone do not automatically justify multiple tenants. When the same administration and data region are sufficient, groups, policies, and Custom Roles are often simpler.

What Enterprise centralizes

Depending on license and function, the Enterprise layer can:

• create, search, and open sub-estates,
• show license status and usage across estates,
• manage Enterprise administrators,
• aggregate Alerts from approved sub-estates,
• distribute global templates and selected settings,
• operate API Credentials at Enterprise level,
• allocate master licenses to sub-estates.

Product functions and local characteristics remain relevant in each sub-estate. An Enterprise template can lock and distribute settings but replaces neither a pilot nor local validation.

Global templates have clear limits

Only an Enterprise Super Admin can manage global templates. A template can cover no more than 500 sub-estates, with a combined maximum of 5,000 devices across those sub-estates. As soon as a sub-estate is assigned to a template, the global settings and policies covered by it are locked in the local Sophos Fusion Admin. They take effect when the template is pushed.

A push overwrites existing base policies and can take a few minutes. If the template is later deleted or the sub-estate is unassigned, the sub-estate retains the last settings pushed. Therefore, pilot a template with a small group of sub-estates first. Record the affected local policies before pushing, then check the push status and the expected policies and settings in every pilot sub-estate.

Access still requires consent

When Enterprise Management is enabled, associated accounts are linked as sub-estates. An Enterprise administrator can open an existing sub-estate only after a Super Admin in that sub-estate approves Enterprise access.

This approval is far-reaching: the Enterprise administrator becomes a Super Admin in the sub-estates. After a sub-estate grants access, only an Enterprise Super Admin can reverse the link or opt-in.

Data region and new sub-estates

Select a data region when creating a new sub-estate. Depending on availability, Sophos offers locations including the United States, Canada, Ireland, Germany, Australia, India, Brazil, and Japan. The default matches the primary sub-estate’s region.

Before creation, align the region with privacy, latency, integration, and legal requirements. A later tenant migration is considerably more complex than choosing correctly at the start.

Roles and personal accounts

Enterprise roles are separate from roles in an individual Sophos Fusion Admin tenant. A dedicated Enterprise administrator account prevents daily tenant work from constantly using organization-wide Super Admin permissions.

Only an Enterprise Super Admin can create API Credentials at Enterprise level. Dedicated service principal roles, expiration monitoring, and secret rotation apply there as well.

Alerts and reports

Enterprise can show Alerts from approved sub-estates and support actions. The current Enterprise view includes Alerts for up to 90 days and no more than 2,500 entries. Open the relevant sub-estate or use a SIEM for older or larger investigations.

Custom dashboards can show data from one or multiple sub-estates. In Dashboards > Manage Dashboards, the Creator column identifies the administrator who created a custom dashboard.

Sophos and custom dashboards can be exported as PDFs, but Central Overview cannot. Map-based widgets appear as blank areas in the PDF. If PDF exports are part of reporting, do not use those widgets as the only evidence.

Licensing models

Sub-estates can retain individual licenses or move to Enterprise Master Licensing. Master licenses form a shared pool and are allocated centrally. Migration cannot be reversed and therefore requires separate license and cost planning.

Plan and enable Sophos Central Enterprise Master Licensing explains transfer, consolidation, and allocation limits.

Plan the structure before activation

Create a matrix before enabling Enterprise Management:

Technical activation is covered in Enable Sophos Central Enterprise Management.

Frequently asked questions