Hi RyanHosiassohn 

As of now You can apply Central Device Encryption to system volumes and fixed data volumes but not devices which are treated as removable media. BitLocker can be used to encrypt such as system volumes and fixed data volumes and these encrypted clients can be managed via the central console.

Encrypting the external storage devices is not possible with Central Device encryption. Please refer the below KBA for more details.

FAQ on Sophos Central Device Encryption (Windows)

Thanks for the info. 

Ok, So my next question is more for the Bitlocker side of things.

Because Sophos encryption uses Bitlocker. this gives an option for the use of Bitlocker to Go on removable media. 

If I enable bitlocker to go on a removable drive and have the Key saved on the local AD, Would this correctly save these keys to the user profile and once saved would it decrypt the drive once the user has logged into the PC, So in essence would the encrypted removable device de-crypt using the key stored on the AD after the user has been authenticated ? 

Hi RyanHosiassohn 

Unfortunately, when you use BitLocker to go to encrypt the removable drives and the save the keys in the local AD, it is not saved with the user profile in Sophos central. Thus the BitLocker to go keys or the removable volumes will not be managed by Central Device Encryption.

You can vote the existing feature request to Alerting and Bitlocker to Go

Hi Gowtham Mani

Thanks, yeah I gathered it wouldn't be saved in the Sophos Central side. But if saved on the local AD.

Would it still unlock the removable drive once authenticated.

Hi RyanHosiassohn 

Saving the keys in the local AD will not unlock the removable drive using Central Device Encryption.