Prevent ZTNA installation on newly added clients

Thank you for reaching out to the community forum.

Based on the description you've mentioned above. It looks like Agent-base Policy is currently enabled on your ZTNA.

You may need to change this to Agentless settings in order for ZTNA not to get pushed when you install Sophos endpoint on your devices.

Hi Glenn,

But how am I able to further test agent based ZTNA on one specific device with one specific user then? Don't I need the agent based policy in order to test this stuff in the first place? I just want it to be enabled for one specific device, not automatically for all fresh installations. That is ridiculous.

I'd suggest using the "--products=" command line option to specify which components you'd like to deploy. By leaving "ztna" absent from the list you populate, you can prevent it from being deployed. 

Installer command-line options for WIndows

Products to install

Specifies a list of products to install. If you specify a product that you don't have a license for, then it isn't installed.

--products=<comma-separated list of products>

Trailing argument

Comma-separated list of products to install.

Available options are: antivirus, intercept, mdr, xdr, deviceEncryption, ztna, none, or all.

I'd suggest using the "--products=" command line option to specify which components you'd like to deploy. By leaving "ztna" absent from the list you populate, you can prevent it from being deployed. 

Installer command-line options for WIndows

Products to install

Specifies a list of products to install. If you specify a product that you don't have a license for, then it isn't installed.

--products=<comma-separated list of products>

Trailing argument

Comma-separated list of products to install.

Available options are: antivirus, intercept, mdr, xdr, deviceEncryption, ztna, none, or all.