Sophos Central Global Templates exclusions

Hi JerzyT 

Global exclusions through global templates can be pushed to all the customers but Policy-based exclusions can't be pushed to the customers.

For Global exclusions through global templates, please refer to this article.

For base policy push through global templates, please refer to this article.

thanks for answer Jasmin,

it's the global exclusions that we would like to push on a partner level alright.

we are just not clear on whether we can push exclusions without affecting base policies.

JT

Hi JerzyT 

It is possible to add global exclusions without disturbing the base policies as both are a different setting under global templates.

ok this is great news.

May I ask where in global template do we disable the base policies?

We assign global template to a customer, setup exclusions and then are ready to "push" but how to make it so that customer's base policies aren't overwritten?

We do have number of customers that have custom base policy settings so we have to make sure none of these are affected when we push the global template.

Hi JerzyT 

You can't disable or delete the base policy. It is always available and is used if you don't have other policies. The global exclusions which you create under global templates will be applied to all your users and their machines as well as servers. If the managed customer is part of a Global Policy template, the base policy cannot be edited locally. If a policy change is required (for base policy) this can only be done by the Super Admin. Alternatively, the local administrator can create a separate local policy above the base policy. Please refer to this article for more information.

Hi JerzyT 

You can't disable or delete the base policy. It is always available and is used if you don't have other policies. The global exclusions which you create under global templates will be applied to all your users and their machines as well as servers. If the managed customer is part of a Global Policy template, the base policy cannot be edited locally. If a policy change is required (for base policy) this can only be done by the Super Admin. Alternatively, the local administrator can create a separate local policy above the base policy. Please refer to this article for more information.

ah so it is indeed not possible to push global exclusions to customers without affecting base policies :/

Hi JerzyT 

Sorry, but it is somewhat tricky to set. What you can do is that, without disturbing the base policies, simply set the global exclusion and assign them to customers.

ok I see but this would still push the base policy to customers and any changes previously made on base policies would be replaced I think?

and this here would be an issue as we have made changes to number of base policies across many customers to accommodate to their requirements.

Hi JerzyT 

In this matter, you are correct that it could affect the base policies which are already changed from the default settings.

But you can do the exclusion for the new customer who is going to be added in your partner dashboard as they were yet to be done the changes in their policies.

ok thanks for clarification. we may look at bringing all base policies inline as being able to push exclusions on a partner level would save us a lot of time.

Hi JerzyT 

You're welcome. Please let us know in case you face any other issue while implementing this on your customers.