When a device is enrolled in Early Access, many of the Sophos service tags for registry keys go from RECOMMENDED to BETA.
Upon reviewing the results of this query, if any devices return with "data" : "BETA" - those devices are in the early access program.
Query to run:
"SELECT data FROM registry WHERE path LIKE 'HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Sophos\\AutoUpdate\\Service\\CloudSubscriptions\\Base\\tag'"
