Sophos Mac Endpoint: How to Configure JAMF Privacy Preferences for 10.15+ Compatibility

Disclaimer: This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment.

.We have made this process significantly easier. Our installer download now includes an MDM profile for permissions and a script for use to deploy the endpoint via MDM. Here are our instructions for how to use these. It is written for JAMF Pro, however the MDM profile and script should work in other MDM solutions.

docs.sophos.com/.../index.html

Overview

This article describes the steps to configure JAMF to allow configure permissions for Sophos Mac Endpoint on macOS 10.15+

Applies to the following Sophos products and versions
Sophos Central Mac Endpoint 10.0.0 and above,
Sophos Central Intercept X 10.0.0 and above,
Sophos Central Device Encryption 1.5.2 and above,
Sophos Anti-Virus for Mac OS X 9.9.7 and above

Overview
Technical Context
What to do
Related videos
Related information
- - JAMF Pro keys for 10.0.2 EAP to pre-approve the proxy configuration

Technical Context

With macOS 10.13, Apple introduced a new security level that required each 3rd party vendor's kernel extension to be approved. This required Team ID to be allowed, also known as the Apple Developer ID.

With macOS 10.15, Apple added a new default behavior that prevented applications from writing to the disk.

The information below covers both topics:

Allowing the Sophos Team ID (2H5GFH3774)
Granting the disk access for each required process

To alert and inform users, Sophos implement a notification popup. The endpoint will check after each reboot (and continuously every 30 minutes) if the system permissions are compatible.

This following steps can also be applied to machines running macOS 10.14.x. You may want to prepare your devices to be ready for an upgrade to macOS 10.15+. The instructions below can be followed to prepare device profiles for a future macOS 10.15+ upgrade.

Note: In Sophos for Mac 9.9.5, a notice is displayed if required permissions are not fully enabled. On October 31st, an issue was found where the notice is triggered if the permissions have been added via an MDM profile, as Apple records these in a different location. Sophos is actively working on updating the detection to correct this.

What to do

There are 2 steps required to configure compatibility for macOS 10.15.x (Catalina) and below.
Note: One additional step is required if you want to apply the profile to a macOS 11 (Big Sur) device.

Grant full disk access for Sophos components
Allow the Sophos kernel extensions
(Big Sur - macOS 11) Configure the system extension at the last step.

Grant full disk access for Sophos components

Open JAMF and log in.
Go to Computers > Configuration Profiles
Create a new Configuration Profile, or select an existing one
Select Privacy Preferences Policy Control (near the bottom of the list)
Click the + beside App Access

In Identifier and Code Requirement put in all the entries listed below, and for Identifier type, select BundleID.
Note: Sophos does not recommend using the path based format

Identifier	Code Requirement	Valid Since	Product
com.sophos.endpoint.scanextension	identifier "com.sophos.endpoint.scanextension" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists / and certificate leaf[field.1.2.840.113635.100.6.1.13] / exists */ and certificate leaf[subject.OU] = "2H5GFH3774"	v10.0.2	All
com.sophos.liveresponse	identifier "com.sophos.liveresponse" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists / and certificate leaf[field.1.2.840.113635.100.6.1.13] / exists */ and certificate leaf[subject.OU] = "2H5GFH3774"	v10.0.1	Central only
/Library/Sophos Managed Detection and Response/SophosMDR	identifier SophosMDR and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists / and certificate leaf[field.1.2.840.113635.100.6.1.13] / exists */ and certificate leaf[subject.OU] = "2H5GFH3774"	v10.0.1	Central with MDR only
com.sophos.autoupdate	identifier "com.sophos.autoupdate" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists / and certificate leaf[field.1.2.840.113635.100.6.1.13] / exists */ and certificate leaf[subject.OU] = "2H5GFH3774"	v10.0.0	OPM only
com.sophos.macendpoint.CleanD	identifier "com.sophos.macendpoint.CleanD" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists / and certificate leaf[field.1.2.840.113635.100.6.1.13] / exists */ and certificate leaf[subject.OU] = "2H5GFH3774"	v10.0.0	All
com.sophos.SophosScanAgent	identifier "com.sophos.SophosScanAgent" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists / and certificate leaf[field.1.2.840.113635.100.6.1.13] / exists */ and certificate leaf[subject.OU] = "2H5GFH3774"	v10.0.0	All
com.sophos.macendpoint.SophosServiceManager	identifier "com.sophos.macendpoint.SophosServiceManager" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists / and certificate leaf[field.1.2.840.113635.100.6.1.13] / exists */ and certificate leaf[subject.OU] = "2H5GFH3774"	v10.0.0	All
com.sophos.endpoint.uiserver	identifier "com.sophos.endpoint.uiserver" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists / and certificate leaf[field.1.2.840.113635.100.6.1.13] / exists */ and certificate leaf[subject.OU] = "2H5GFH3774"	v10.0.0	Central only
com.sophos.SDU4OSX	identifier "com.sophos.SDU4OSX" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists / and certificate leaf[field.1.2.840.113635.100.6.1.13] / exists */ and certificate leaf[subject.OU] = "2H5GFH3774"	v10.0.0	All
com.sophos.endpoint.SophosAgent	identifier "com.sophos.endpoint.SophosAgent" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists / and certificate leaf[field.1.2.840.113635.100.6.1.13] / exists */ and certificate leaf[subject.OU] = "2H5GFH3774"	v10.0.0	All
com.sophos.SophosAntivirus	identifier "com.sophos.SophosAntiVirus" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists / and certificate leaf[field.1.2.840.113635.100.6.1.13] / exists */ and certificate leaf[subject.OU] = "2H5GFH3774"	v10.0.0	All
com.Sophos.macendpoint.SophosSXLD	identifier "com.Sophos.macendpoint.SophosSXLD" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists / and certificate leaf[field.1.2.840.113635.100.6.1.13] / exists */ and certificate leaf[subject.OU] = "2H5GFH3774"	v10.0.0	All

In Code Requirement, this can also be self-generated. Run the following on a Mac with version 10.0.0 (Sophos Central) and above:
```
codesign --display -r - <app path from table above>
```
Once it has been added, permissions can be selected accordingly. Each one should be given "All Files" / "SystemPolicyAllFiles" as the access.
Save and deploy the configuration as needed.

Allow the Sophos Kernel Extensions

The same profile can be used, but the option "Approved Kernel Extensions" needs to be selected. If this is not configured yet, select the "open" button at the center to begin the configuration.

During configuration, 3 kernel extensions will need to be added, as well as the Sophos Team ID [2H5GFH3774]

Note: Please ensure that "Allow users to approve kernel extensions" is unchecked.

Referring to the screenshot above, add the following kernel extensions:

com.sophos.nke.swi
com.sophos.kext.sfm
com.sophos.kext.oas

Make sure to save your changes.

(Big Sur - macOS 11) Configure the system extension

Note: Apple has added a new, optional, method of setting authorization of applications for Privacy in Big Sur with MDM. This new method replaces an existing true/false option with a string value option instead. Here is the Apple article on it: https://developer.apple.com/documentation/devicemanagement/privacypreferencespolicycontrol/services/identity Allowed is the normal method of setting permissions, however as of Big Sur, Apple allows you to instead use Authorization. Our detection for permissions has been configured for the “Required” property (which isn’t actually required if you have Authorization instead). If you can set your MDM provider to use the Allowed True/False (Boolean) setting, it should work without any issues. To check if this applies to you, open the .mobileconfig file in a text editor and search for Sophos. Check if you see - <key>Allowed</key><True/>, or <key>Authorization</key><String>Allow</string>. If it is Authorization, this applies to you. We do recognize that there is a move to this alternate form, and as such, we have made an improvement, coming out in our 10.1.3 release in July, to detect both versions. Until this releases, we recommend using the Allowed True/False style privacy permission setting for Sophos processes.

The same profile configuration can be used.

From the Options, select “System Extensions”.
1. This step is similar to the ones above, but for the new system extensions
The following empty template will be displayed
For the display name, specify the following entries
1. com.sophos.endpoint.networkextension
2. com.sophos.endpoint.scanextension
Add 1 entry for each. Make sure that the System Extension Types are set to “Allowed System Extensions”
1. The picture displays a complete profile example. For the Team Identifier, specify the Sophos Team ID [ 2H5GFH3774 ]
Reference the following screenshot for an example of the Options overview
Don't forget to save your changes

Alternate method

Note: Sophos does not guarantee the security of third party applications and they should be used at your own risk.

There is a utility called PPPC Utility on Github which allows you to build a configuration profile for Privacy Preferences. It can be located here: https://github.com/jamf/PPPC-Utility. To use this, follow the guidance on the link, and drag and drop the Sophos items into it.

This profile can then be loaded into JAMF.

Related information

JAMF Pro keys for 10.0.2 EAP to pre-approve the proxy configuration

Special thanks to mscottblake for sharing this!

Within the same Configuration Profile, add a Content Filter payload (this requires Jamf Pro 10.26+) with the following keys and values configured:

Filter Name	SophosWebNetworkExtension
Identifier	com.sophos.endpoint.network
Network Filter Bundle Identifier	com.sophos.endpoint.networkextension
Network Filter Designated Requirement	identifier "com.sophos.endpoint.networkextension" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists / and certificate leaf[field.1.2.840.113635.100.6.1.13] / exists */ and certificate leaf[subject.OU] = "2H5GFH3774"

Note that the Filter Name can be anything, but it is required.

Once the complete, the payload should look like this:

Content Filter payload

JAMF page about this configuration: https://www.jamf.com/jamf-nation/articles/553/preparing-your-organization-for-user-data-protections-on-macos-10-14
PPPC Utility: https://github.com/jamf/PPPC-Utility

Edit Disclaimer
[edited by: GlennSen at 3:48 PM (GMT -7) on 5 Apr 2023]

Top Replies

jknight over 2 years ago +4

I have followed the instructions on this article. However, in Big Sur I am still getting the prompts to allow the System Extensions for SophosScanD and SophosWebNetworkExtension. I have a configuration…

Parents

Matthew Hegge over 2 years ago

This popped up again this week. All setting via KB article does not fix. Also created a Config Profile for JAMF using PPPC Utility. No joy! All of my Catalina users are experiencing the issue. Sophos Endpoint v10.0.1
Cancel
Vote Up +1 Vote Down

Sign in to reply

Cancel
PavSupport over 2 years ago in reply to Matthew Hegge
I will provide the same reply in the support case, but here is what needs to be done:

In Sophos version 10.0.1 both the Live Response and MDR have to be approved, or you see the pop-up (even if you don't have the license).

Solution: The admins will have to add 2 more lines via Sophos MDM, Jamf or other MDM solutions:

SophosLiveResponse: identifier "com.sophos.liveresponse" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "2H5GFH3774"

SophosMDR: identifier "com.sophos.liveresponse" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "2H5GFH3774"

This macOS 10.15+ Security Permissions Required KB will also show all the components required to be added to the Full Disk Access in MacOS.

Additional resources:

Sophos KEXT files for Mac explanation: https://sophos.lightning.force.com/lightning/r/Knowledge__kav/ka03Z0000000FNGQA2/view

Terminal command to list all Sophos kext files: kextstat | grep Sophos

MacOS location and files required to be listed under MacOS System Preferences/ Security&Privacy/Full Disk Access: /Library/Sophos Anti-virus

SophosAutoUpdate (Enterprise Console managed only)

SophosCleanD

SophosScanAgent

SophosServiceManager

Sophos Endpoint UIServer (Central Managed only)

SophosLiveResponse (Central only)

SophosMDR (Central with MDR only, from /Library/Sophos Managed Detection and Response)

Sophos Diagnostic Utility (from /Library/Sophos Anti-virus/tools/)

Hope that helps!
Cancel
Vote Up 0 Vote Down

Sign in to reply

Cancel
Matthew Hegge over 2 years ago in reply to PavSupport

The additional lines you suggest adding do not make sense, they are the same. I added one of them. No change.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Cancel

Reply

Matthew Hegge over 2 years ago in reply to PavSupport

The additional lines you suggest adding do not make sense, they are the same. I added one of them. No change.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Cancel

Children

Peter Berec over 2 years ago in reply to Matthew Hegge

@Matthew Hegge

been working on this issue since last week. I added the two bundle IDs and code requirement per Sophos to my Jamf PPPC payload config and still not working. BTW the code req for SophosMDR should be:

identifier "com.sophos.SophosMDR" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "2H5GFH3774"

But I tried already and still not working. Sophos thought there was a white space in their code requirement for SophosMDR prior to 11/13 afternoon in this KB but even the corrected code it still not working.

My thought is that 10.0.1 broke something that is now causing this re-trigger of Full Disk Access. Here their release notes for 10.0.1 essentially confirming such. I asked for when 10.0.2 will come out in the hopes they are aware and working on fix but no reply from them yet.

http://downloads.sophos.com/readmes/savmosx_10_cld_rneng.html

If anyone finds solution please post.
Cancel
Vote Up +1 Vote Down

Sign in to reply

Cancel
Sophos User3338 over 2 years ago in reply to Peter Berec

We have the same issue, which caused all our machine to flag to users that they need to make changes under 10.0.1 I raised this to support who just pointed me back to this page.
Cancel
Vote Up +1 Vote Down

Sign in to reply

Cancel
Benjamin Burton over 2 years ago in reply to Sophos User3338

We're having the same issue. Another item on my list of reasons to move away from this blighted product.
Cancel
Vote Up +2 Vote Down

Sign in to reply

Cancel
Matthew Hegge over 2 years ago in reply to Peter Berec

Waiting for an update on the newer version. Nowthing ths far has cured the issue on Catalina or Big Sur
Cancel
Vote Up +1 Vote Down

Sign in to reply

Cancel
Rapa601 over 2 years ago in reply to Matthew Hegge

Done now. Please let us know if there is something missed / still not working.
Cancel
Vote Up +2 Vote Down

Sign in to reply

Cancel
Matthew Hegge over 2 years ago in reply to Rapa601

I am still at a loss. Nothing has worked thus far. I do not have access to any new versions, if they are available.
Cancel
Vote Up +1 Vote Down

Sign in to reply

Cancel
Rapa601 over 2 years ago in reply to Matthew Hegge

Hi Matthew,
the current version of Sophos Central Endpoint Protection for macOS would be 10.0.1. If you join the Early Access Program (EAP) to get the first version for macOS 11 (Big Sur) - you will get version 10.0.2.
For more details about this version - please see the following article.
https://community.sophos.com/intercept-x-endpoint/big-sur-eap/b/announcements/posts/welcome-to-the-big-sur-eap
Cancel
Vote Up 0 Vote Down

Sign in to reply

Cancel
Matthew Hegge over 2 years ago in reply to Rapa601

We still need a solution for Catalina, as nothing up to this point has worked.
Cancel
Vote Up +1 Vote Down

Sign in to reply

Cancel
Rapa601 over 2 years ago in reply to Matthew Hegge

We was working again and add now the information about - what version introduce which new feature. As well we added few more screenshots to show how it should locks like within JAMF.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Cancel
Matthew Hegge over 2 years ago in reply to Rapa601

I re-configured my MDM Configuration Profile based on the revised article. The configuration requires user interaction and admin rights so this is NOT a viable solution.
Cancel
Vote Up 0 Vote Down

Sign in to reply

Cancel