We plan to manage USB via Sophos central Globally. The Exemption of users globally would be managed via IAM (means the group ll be on AD) We are doing this kind of setup so that the Service Desk can resolve this at first level and we do not want to grant L1 team access to Central. They can just make changes on IAM tool and the AD sync should push this group multiple times.
Hmmm, that sounds like a good idea but I don't think AD Sync will allow this. Hopefully someone from Sophos can jump in. I am pretty sure 2 syncs per day is the maximum you can achieve at this time.
Quote