Overview

This article describes the steps to configure JAMF to allow configure permissions for Sophos Mac Endpoint on macOS 10.15 Catalina

The following sections are covered:

• What to do
• Related information
• Feedback and contact

Applies to the following Sophos products and versions
Central Mac Endpoint 9.9.4
Sophos Anti-Virus for Mac OS X 9.9.4

WARNING

In Sophos for Mac 9.9.5 we added a notice if the permissions are not fully enabled. On October 31st we found an issue that triggers this notice if the permissions have been added via an MDM profile, as Apple records these in a different location. We are working on updating our detection to correct this and will update frequently.

What to do

1. Open JAMF and log in.
2. Go to Computers->Configuration Profiles
3. Create a new Configuration Profile, or select an existing one
4. Select Privacy Preferences Policy Control (near the bottom of the list)
5. Click the + beside App Access
   
   
6. In Identifier and Code Requirement put in all the entries listed below, and for Identifier type, select BundleID
   

   Identifier	Code Requirement	Product
   com.sophos.autoupdate	identifier "com.sophos.autoupdate" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "2H5GFH3774"	OPM Only
   com.sophos.macendpoint.CleanD	identifier "com.sophos.macendpoint.CleanD" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "2H5GFH3774"	All
   com.sophos.SophosScanAgent	identifier "com.sophos.SophosScanAgent" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "2H5GFH3774"	All
   com.sophos.macendpoint.SophosServiceManager	identifier "com.sophos.macendpoint.SophosServiceManager" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "2H5GFH3774"	All
   com.sophos.endpoint.uiserver	identifier "com.sophos.endpoint.uiserver" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "2H5GFH3774"	Central Only
   com.sophos.SDU4OSX	identifier "com.sophos.SDU4OSX" and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = "2H5GFH3774"	All

   
   
7. In Code Requirement you can also generate this yourself. You will need to run the following on a Mac with 9.9.4: "codesign --display -r - <app path from table above>"
8. Once it has been added, you can select the permission to give it. Each one should be given "All Files"/"SystemPolicyAllFiles" as the access.
9. Save and deploy the configuration as needed.
   

Alternate method

Note: Sophos does not guarantee the security of third part applications and they should be used at your own risk.

There is a utility called PPPC Utility on Github which allows you to build a configuration profile for Privacy Preferences. It can be located here: https://github.com/jamf/PPPC-Utility.  To use this, follow the guidance on the link, and drag and drop the Sophos items into it.

This profile can then be loaded into JAMF.

Related information

• JAMF page about this configuration: https://www.jamf.com/jamf-nation/articles/553/preparing-your-organization-for-user-data-protections-on-macos-10-14
• PPPC Utility: https://github.com/jamf/PPPC-Utility

Sign up to the Sophos Support SMS Notification Service to get the latest product release information and critical issues.

Feedback and contact

If you've spotted an error or would like to provide feedback on this article, please use the section below to rate and comment on the article.
This is invaluable to us to ensure that we continually strive to give our customers the best information possible.