Sophos Endpoint and Apple macOS 11 Big Sur

The EAP is now open/live

After giving various Sophos apps full disk access, it seems to work. Is there a list available for everything it needs? 

In Security & Privacy (full disk access) I see the following Sophos apps (?) that I have given full disk access:

SophosMDR
Sophos Diagnostic Utillity.app
SophosScanAgent.app
SophosScanD.app
com.sophos.endpoint.scanextension.systemextension
Sophos Endpoint UIServer.app
SophosCleanD.app
SophosServiceManager.app

Is that more than is needed or incomplete?

support.sophos.com/.../KB-000039501

Yeah, that page content seems to omit stuff?

Not everything needs full disk access, we will have the same single icon (that we have for 10.15) to drop in for file access when we GA.

I can report this: When removing all those Sophos related full disk access permissions, removing them from the privacy control panel, rebooting and all... Sophos Endpoint doesn't (re) ask for anything. According to the status panel all is jolly good. Also Sophos Central deems it okay. That doesn't seem like normal/predictable behavior. I would expect, when withdrawing permissions, the app would ask again to add them.

UPDATE: After about 20 minutes it asked again for those permissions. So I added them as instructed. I'll report back later if this is resolved completely.

I can report this: When removing all those Sophos related full disk access permissions, removing them from the privacy control panel, rebooting and all... Sophos Endpoint doesn't (re) ask for anything. According to the status panel all is jolly good. Also Sophos Central deems it okay. That doesn't seem like normal/predictable behavior. I would expect, when withdrawing permissions, the app would ask again to add them.

UPDATE: After about 20 minutes it asked again for those permissions. So I added them as instructed. I'll report back later if this is resolved completely.

So, if one clears all permissions and let Sophos re-request them, and dragging the icon from the Sophos popup into MacOS's full disk permissions it adds and activates the following apps:

SophosMDR
Sophos Diagnostic Utility.app
SophosScanAgent.app
com.sophos.endpoint.scanextension.systemextension
Sophos Endpoint UIServer.app
SophosCleanD.app
SophosServiceManager.app

It also adds the app below, which wasn't there previously, but doesn't tick its box:
Sophos Scan.app

It did not add the app below, that was added previously:
SophosScanD.app

Looking into the Knowledge Base articles, it seems those are not completely updated, but I'm not sure if this will be different when Sophos goes GA.

Harlock KBAs get updated one by one until testing is completed and shortly before the GA release. Often Sophos needs feedback and sufficient testing experience before they can reflect solutions in KBAs. I would give it some time.

Well, I expected that much, so consider my reply above as feedback.

Update: There might be a problem. The install seems to work, also according to diagnostics, however when I download an Eicar file nothing trips realtime scanning. Manual scanning does detect the Eicar files, so it seems to be an issue with real time scanning.

works here. im using test files from eicar.org. sophos has detected the thread and blocked it.

Thanks, I'll do a remove and reinstall to see if that helps.

Regret to say that this didn't help at all. I just can happily download Eicar files. This is somewhat disconcerting.