Note: This information is provided as-is for the benefit of the Community. Please contact Sophos Professional Services if you require assistance with your specific environment.

---

Overview

This knowledge base article provides a high-level overview on how to use Microsoft Intune to deploy the Sophos Central Windows endpoint software.

The following information could also be used as a guide when deploying the Sophos Enterprise Console (SEC) managed client.

The steps below are provided with the assumption that Intune has already been used to deploy packages to Windows endpoints and you are already familiar with the general workflows described.

The following sections are covered:

• Table of Contents

  • Overview
  • What to do 
    • Create the .intunewin file from the Sophos Central installer file
    • Create the Win32 app within Intune
  • Related information
  
  
  

Applies to the following Sophos product(s) and version(s)
Central Windows Endpoint
Sophos Endpoint Security and Control

What to do 

Create the .intunewin file from the Sophos Central installer file

1. Create the following folders using a Command Prompt with admin privilege:
   
   
   1. md C:\Temp
   2. md C:\Temp\IntunePackageSource
   3. md C:\Temp\IntunePackageOutput
   4. md C:\Temp\Intune-Win32-App-Packaging-Tool-master
2. From your Sophos Central account, download SophosSetup.exe and save it at C:TempIntunePackageSource.
3. From Github, download the Microsoft Win32 app packaging tool (IntuneWinAppUtil.exe) and save it at C:\Temp\Intune-Win32-App-Packaging-Tool-master.
4. Using a Command Prompt, run the packaging tool from the specified folder.
5. When prompted, specify the following:
   
   
   • Source folder: C:\Temp\IntunePackageSource
   • Setup file: SophosSetup.exe
   • Output folder: C:\Temp\IntunePackageOutput
   • Catalog folder: N

The message INFO File 'C:\Temp\IntunePackageOutput\SophosSetup.intunewin' has been generated successfully will be displayed. 

Create the Win32 app within Intune

1. Log in to your Azure AD tenant with an account that has the required access to manage Intune.
2. Search for and click Intune.
3. In the left navigation column, click Client apps.
4. Under the Manage section click Apps.
5. Click on the Add button.
6. Click the drop-down for app type then select Windows app (Win32).
7. Select SopphosSetup.intunewin file from C:\Temp\IntunePackageOutput then click OK.
8. The app information can then be configured as follows:
   
   
   • Name: Sophos Central
   • Description: Advanced endpoint protection coupled with a simple, intuitive user experience
   • Publisher: Sophos Ltd
   • Information URL: www.sophos.com/.../sophos-central.aspx
   • Privacy URL: www.sophos.com/.../product-privacy-info.aspx
9. Enter the install and uninstall commands then click OK.
   
   
   • Install command: SophosSetup.exe --quiet
     
     For more information on the available command-line options, take a look at the KBA Sophos Central Endpoint: Installer command line options for Windows and Mac.
     
     
   • Uninstall command: %ProgramFiles%\Sophos\Sophos Endpoint Agent\uninstallcli.exe
10. Enter the OS architectures you wish to deploy to then click OK.
11. Enter the detection rule then click the succeeding OK buttons.
    
    
    • Rule type: File
    • Path: %ProgramFiles%\Sophos\Sophos UI
    • File or folder: Sophos UI.exe
    • Detection method: File or folder exists.
    Note: There are potentially several markers that indicate Sophos Cloud endpoint is already installed. The example above is a component that is only installed as part of the Sophos Central product compared to the on-premise solution. Therefore, this would allow for migrations to Sophos Central. You may wish to add additional rules for other Sophos Central components such as the files of the Sophos Management Communication System (MCS) to harden the detection method.
    
    
    
12. Leave the return codes and scope (tags) as default then click Add.
13. Once your app is ready, click on Assignments.
14. Click Add Group then assign the application to your required group.

Related information

• Intune Standalone - Win32 app management
• Sophos Central Admin: Endpoint protection deployment methods
• SophosZap: Frequently Asked Questions

Sign up to the Sophos Support Notification Service to get the latest product release information and critical issues.

PS note
[edited by: Qoosh at 7:46 PM (GMT -7) on 19 Aug 2021]