I have the problem that one of our consultants is using a Mac Book with MacOS Catalina 10.15.3 and for troubleshooting purposes must / wants to quit Intercept X Advanced. If he now clicks on "Quit", the Sophos Agent will restart itself. Even if tamper protection is disabled.
He is using:
We're currently running the SDU, if you need specific log files please let me know.
Were you looking into ways to completely disable Sophos? You can uncheck all of the features within the Endpoint UI.
Or to just remove Intercept X you can unassign this software from the Endpoint if you have Sophos Central.
Otherwise Sophos Endpoint can be uninstalled from the Mac while doing the said troubleshooting process.