Same behaviour was seen on most of the devices running BigSur and Sophos EAP.

These are showing in their status that SophosScanD is not started.

"Not started: SophosScanD"

Devices are enrolled and managed by M365  Intune.

Hi Nicholas,

The problem appears to the in the authorization for the scan extension, as shown in the command line output. If it's not authorized it won't run, and that in turns prevents SophosScanD from running correctly.

If the General tab of macOS' Security & Privacy panel doesn't show anything then perhaps that's something that could be done via MDM - our IT department uses JAMF and is working on allowing/authorizing via that.

Hi David,

We're noticing that all of our M1 Macs that have updated to 10.0.3 have this issue. When running systemextensions ctl, they're all showing 0 extensions

Hey Roger, this is peculiar - are you able to take a look in the General tab of the Security and Privacy panel and let me know if there's anything requiring authorization? 

We'd really love to see an SDU from an affected machine, it would help a lot.

hi, we see the same issue , I have to say I dont see a solution that makes sense up to now. I am extremally disappointed with sophos support on the EAP  program . also we dont have a choice when we install new MAC and update as it updates to 11.2.1 and we are stuck

10.0.3 Update - SophosScanD stopped

Hi David, I can confirm that the extensions were present in the General Tab, both SophosScanD and the WebNetworkExtension. Unfortunately for me, as soon as the Web Network Extension was enabled that clashed with Zscaler client and now I have more users complaining about Sophos ... I do have a separate ticket for the other extension but the whole things is very disappointing. 

Hi Robert, I'm sorry Support hasn't been helpful hopefully I can offer provide more information here.

The extensions approval is managed by the OS and unfortunately we don't have any control over how that works. SophosScanD showing as not running is correct due to the fact it is unable to scan files, as the scan extension has not been approved to run yet.

Hi Nicholas,

I understand your frustration, hearing about these incompatibilities is disappointing to us too. The EAP program is so valuable to us for exactly these reasons, we get to hear about issues we wouldn't normally encounter and hopefully engage with customers to help understand them.

As disappointing as they are, these challenges aren't entirely surprising. There are new technologies introduced with Big Sur and these products could be using them in ways that clash, it's even possible that bugs in the OS currently prevent them from working together - as seen with the recently remedied NEFilterDataProvider and NETransparentProxyProvider.

I realize this doesn't help your situation but I assure you that we have team members collating information regarding these incompatible products to aid in our investigation.

Hi Nicholas,

I understand your frustration, hearing about these incompatibilities is disappointing to us too. The EAP program is so valuable to us for exactly these reasons, we get to hear about issues we wouldn't normally encounter and hopefully engage with customers to help understand them.

As disappointing as they are, these challenges aren't entirely surprising. There are new technologies introduced with Big Sur and these products could be using them in ways that clash, it's even possible that bugs in the OS currently prevent them from working together - as seen with the recently remedied NEFilterDataProvider and NETransparentProxyProvider.

I realize this doesn't help your situation but I assure you that we have team members collating information regarding these incompatible products to aid in our investigation.