VLAN1 tagged uplink


We're new to Sophos switches and have just started deploying our first units.

Am I correct in thinking that the management VLAN can't be changed from VLAN1 to any other VLAN? This seem extremely inflexible. Not every site uses VLAN1. At sites with existing upstream switches and routers this creates a lot of extra work to create an additional VLAN just to support Sophos switches.

What is even stranger to me is that it seems VLAN1 has to be uplinked via an untagged port? I.e. I can't just add VLAN1 as tagged traffic on the switch's uplink to provide internet access for that Sophos switch. Sophos switches seem to demand untagged VLAN1 on their uplink ports?