Sophos licenses a mailbox when it receives an external email.
We have about 20 internal "rooms" in Exchange so it follows that they will only ever receive internal calendar/booking requests, however I found that Sophos had licenses all 20 of those rooms. When I went in and did a mail trace of all email received by the rooms over the past 30 days, this is the result.
So. Sophos sends a welcome email, then picks up that the mailbox has received an external email and then licenses the mailbox.
This thread was automatically locked due to age.
