Sophos Endpoint and Apple macOS 11 Big Sur

We are investigating opening an EAP just for MSP Flex customers, I'll update this thread when I know more. For background, MSP Flex customers do not have access to EAPs due to the way that usage is tracked and billed. We are now looking to create an EAP that works a little differently in the backend so that billing is not affected by EAP use.

investigating? i seriously cannot tell my clients to stop updating to Big Sur or buy any new MacOS device the coming months because they won't be protected by their Sophos Endpoint protection solution. Would be great if we get an EAP for FLex or an invitation code for now...

you have to ... I instructed an update stop for my clients. now I take better the next flight to an island.  far far away from the upcoming .. storm 

Philipp Marx said:

you have to ... I instructed an update stop for my clients. now I take better the next flight to an island.  far far away from the upcoming .. storm 

Not sure, but maybe it would actually be nice to escape to a nice desert tropical island? ;) 

For what it's worth, at this time I can say from the test I did this morning the current EAP doesn't seem to be working on M1. 

The current EAP is not for M1 (ARM) powered devices, as noted in the KB. 

That said, it is possible to get it running on an M1, but you must enable Rosetta-2 from Apple, which is not enabled by default. Please note that this is not tested nor designed for the M1. A later release will bring proper support for the platform.

I've read the KB and off course I'm not testing on production machines, so there is no real urgency for me.

However I'm stating I could NOT get the current EAP of Endpoint working on a brand new M1 Macbook Air. That is with Rosetta 2 activated (it will trigger its install the minute it is faced with Intel code). So my question is, do you guys have an M1 Mac available to you and have you tested this to work? In other words, is the statement the EAP version should work on M1 devices based on experience or theory? 

I'm not trying to be pedantic or a pain. Nor am I expecting real support at this stage. Just want to see if this can be made to work.

Harlock, we have tried it ourselves on an M1 device and got it to work OK

Thanks Darren, do you know if FileVault and the Mac's firewall were active? And was the Mac user login with Active Directory instead of a local account? This is how we set up our Macs and it might matter. Not sure if the chosen setup language matters (we use Dutch).

I don't I'm afraid, I suspect that it would have been a local login, I will ask about FileVault and Firewall later.

With the current EAP on Big Sur I have a similar problem with an Intel Mac, Eicar files are not detected in real time, only with manual scans. Similarly I've seen real time scanning reported as off on the M1 Mac while on the Intel Mac it is reported as on (but fails Eicar tests). That Intel Mac is setup in the same manner (FileVault, firewall and AD login). 

Just thinking out aloud here. But it could be important enough for the development team to look at. however I'm sure you guys have your bases covered when it comes to testing this, at least before it goes GA.

With the current EAP on Big Sur I have a similar problem with an Intel Mac, Eicar files are not detected in real time, only with manual scans. Similarly I've seen real time scanning reported as off on the M1 Mac while on the Intel Mac it is reported as on (but fails Eicar tests). That Intel Mac is setup in the same manner (FileVault, firewall and AD login). 

Just thinking out aloud here. But it could be important enough for the development team to look at. however I'm sure you guys have your bases covered when it comes to testing this, at least before it goes GA.