Is excluding Microsoft application from real time scanning files (local/network) possible?

Hi Masato,

Thanks for reaching out to the Sophos Community Forum. 

It's not currently possible to exclude processes or daemons on macOS. I found an existing feature request for this and have associated it with your account record. 

I'd suggest creating file or folder exclusion for the directories where the problematic applications and files reside, as disabling scanning entirely is not suggested. The following article will help with this.
- macOS scanning exclusions

Do you find that turning off "Real Time Scanning - Files" results in the most improvement, or are you also disabling the "Internet" option as well? 

hi Kushal,

I think turning off Files resulted more effective. But turning off Runtime protection (Cryptguard) is also improving the performance, especially when we run the app.

I tried excluding .pptx and sharepoint & onedrive domain, but didn't help.

On Console.log I can see the below log constantly outputted while loading a file.

Failed to create LSApplicationRecord for file:///Library/SystemExtensions/DA38B7F7-064A-42B8-A234-90CB53BAD736/com.sophos.endpoint.scanextension.systemextension/: 'The operation couldn’t be completed. (OSStatus error -10811.)'

hi Kushal,

I think turning off Files resulted more effective. But turning off Runtime protection (Cryptguard) is also improving the performance, especially when we run the app.

I tried excluding .pptx and sharepoint & onedrive domain, but didn't help.

On Console.log I can see the below log constantly outputted while loading a file.

Failed to create LSApplicationRecord for file:///Library/SystemExtensions/DA38B7F7-064A-42B8-A234-90CB53BAD736/com.sophos.endpoint.scanextension.systemextension/: 'The operation couldn’t be completed. (OSStatus error -10811.)'

I wonder if it could be this issue: https://support.sophos.com/support/s/article/KB-000045805?language=en_US 

Hi Maxim, thank you for the information, I think this is the case, at least with the latest minor ver of Ventura, the performance was normal. I'll try with fresh installed Sonoma 14.3 machine and see it.

According to the advisory, if we use a wiped and freshly installed with machine Sonoma later than 14.2.1, I wonder this issue is supposed to be not reproduced? I've setup a machine with 14.3.1 and it's still outputting the same error message on console at opening PowerPoint slides.

Following the steps on the updated Advisory https://support.sophos.com/support/s/article/KB-000045805?language=en_US, with package ver 2024.1 MR1 and instructed exclusion setting, the performance got significantly improved.