How to store Sophos Central recovery key in both Sophos Central and Active Directory

I believe, at least with SafeGuard this is NOT possible - it's one or the other. You can't have two products "managing" the same thing. This was the case with SafeGuard by design and I'm unsure if it's changed for Central, I would imagine not. Can I ask why you want to use two systems ? Is it for redundancy? 

Yes, it was for redundancy.  Our institution is currently considering ending it's contract with Sophos due to past support issues with Big Sur, Cisco VPN, among other things.  I personally like Sophos Central for the most part, but the documentation for Sophos products can leave some things to be desired.  Currently, we have a scenario on campus where some will do the encryption in Sophos Central while others create GPOs in Active Directory.  Having the encryption keys located in both locations would be a great thing to have for sure.  It's also a little frustrating that they list the ability to Sync with Active Directory, but it doesn't seem to "sync" with common functionality like encryption keys. 

Thanks for the reply. Yes, I had similar wishes too for redundancy but it's by design. You rarely see two different products "manage" the same device. One must be the "master" otherwise what happens when both try to rotate he key at the same time? Who wins - why - what if the right key is used but the wrong server has provided a slightly out of date key? SafeGuard wasn't ever a Sophos product - it belonged to a German company - Utimaco. You can still see references to this in the registry/file paths etc.. With the greatest of respect to Sophos, I don't feel they ever knew the product THAT well and you could tell this in support and documentation. Still a good product - but one support lacked in a little I feel. Central though is I feel a different ball game. I know what you mean ref support for other products/OS. I feel though although it took Sophos a little too long to support Big Sur (other than EAP) it was in the same boat as LOADS of other 3rd parties. Apple changed many things right at the last moment and gave very little time between testing and release - and with significant architecture and system changes.  Feel free to drop me a PM if you'd like to discuss further - I may be in the same sphere as yourself and have had similar/identical challenges! I would recommend getting in contact with your AM at Sophos and explain how you feel so at least they're aware.

Thanks for the reply. Yes, I had similar wishes too for redundancy but it's by design. You rarely see two different products "manage" the same device. One must be the "master" otherwise what happens when both try to rotate he key at the same time? Who wins - why - what if the right key is used but the wrong server has provided a slightly out of date key? SafeGuard wasn't ever a Sophos product - it belonged to a German company - Utimaco. You can still see references to this in the registry/file paths etc.. With the greatest of respect to Sophos, I don't feel they ever knew the product THAT well and you could tell this in support and documentation. Still a good product - but one support lacked in a little I feel. Central though is I feel a different ball game. I know what you mean ref support for other products/OS. I feel though although it took Sophos a little too long to support Big Sur (other than EAP) it was in the same boat as LOADS of other 3rd parties. Apple changed many things right at the last moment and gave very little time between testing and release - and with significant architecture and system changes.  Feel free to drop me a PM if you'd like to discuss further - I may be in the same sphere as yourself and have had similar/identical challenges! I would recommend getting in contact with your AM at Sophos and explain how you feel so at least they're aware.