Intercept X Advanced Expiring - What Happens?

Hi Jordan,

Thanks for reaching out to the Sophos Community Forum. 

After license expiry, there is a 10-day grace period. After this grace period, unlicensed software components are de-assigned. The UI on the endpoint will show that all licensable components are removed.

You are left with the Core components of the endpoint, such as the UI, AutoUpdate, and MCS Communication. Sophos Central will re-assign the original components deployed on the devices when a new license is activated.

Hi there.

So after the grace period, the protection part will automatically deactivate and uninstall itself and and Microsoft Defender (Windows environment, obviously) will kick in?

Thanks,

Mark

I believe this to be correct, although I'm not entirely certain how Windows Defender will react. Some information on defender can be found in the following article. 
- learn.microsoft.com/.../microsoft-defender-antivirus-compatibility

I'd suggest testing this first. You can do so by using the "Manage Endpoint Software" button from Sophos Central. Removing all protections from one test device will give you the same results as though a licence expiry were to occur.