how to check if policies / exceptions are applied to endpoints?

The fastest method to check if new policies are applied is to use the Endpoint Self Help Tool.

Within the Endpoint Self Help Tool you can see under "Management Communication" when a computer successfully communicated with Sophos Central. Additionally you can look at the "Policy" tab where it will display timestamps for the various policy types.

Please note that when running Intercept X Advanced on a server that you should disable Windows Defender, see: https://support.sophos.com/support/s/article/KB-000042286 (this only applies to Server OS's).

One way you can verify if your exclusions are working correctly is by using an EICAR test file. Further information can be found in the following article.
- Sophos Endpoint: Test detection features

If you have a folder exclusion, placing the eicar file within the excluded directory will work to test this in real-time. For process exclusions you may want to get a baseline for speed first without the exclusion present and then test after the exclusion is added.

Thank you.

You can check the registry keys under:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sophos Endpoint Defense\Scanning\Config

if you made an exclusion.

Thanks!