XGS send EMail Quarantine Digest to all mailboxes

Why did you purchase the Email Protection on the firewall (standalone and not part of the firewall bundle) and not the Central Email Product? There is a Promo to migrate UTM to SFOS and get Central Email Protection.

In CEMA you can send the digest to all users as well as you can rethink the approach towards quarantine - For example you could strip content and give the Email without the attachment to the user. If the user wants the content, you can release it as an Admin. Or you can inform admin and user about emails in the quarantine to move certain tasks to users instead. 

Generally speaking, CEMA does a way better job than UTM ever did and gives you more tools as a Admin to work though the modern Email Security. So as someone, who talks to customers and partners on a daily basis, my advice is always to not go with Email Protection on the firewall (UTM or SFOS) and take a look into CEMA. 

Sorry for my tone, that doesnt help. Had some more issues with Sophos, the active license got deleted whilst the XGS was already productive at the customer, stuff like that.

Still I dont get at all why it is not an option to send Quarantine Digests to the mailbox the quarantined mail was addressed to. Way simpler and better than via users/groups. Imo thats a basic thing I just expect for a MTA that supports quarantine at all. Expectation and reality are not the same. Just not thought out at all, but it is what it is and obviously no intention of changing it from Sophos, rather pushing customers into cloud as it is the general trend right now..

Is it still an option to migrate the already activated XGS136 Email Protection AddOn to CEMA? I guess not and in that case it is probably not an option for that customer.

Is there no other option, like at least being able to import all users belonging to an AD group into the XGS via WebAdmin to at least solve the issue that every user has to login into XGS manually? Even via some CSV stuff?

Thanks anyways.

You could use the Import tool like this one:  Sophos Firewall: Importing User definitions into Sophos Firewall after v18.0 MR3 and v17.5 MR14 

 --> You can do a migration SFOS Email to CEMA - But it is a Sales Process. You can ping your local Sales Rep for options. 

The issues are now resolved as far as it is possible for me in this scenario and we will look into migrating to Central Mail Protection (or some alternative product for OnPrem) in time when the XGS EMail Protection runs out and we would need a renewal. If the custome ris happy with how it is, I will keep it this way, lets see how it goes from here.

I already stated what I think of Sophos approach (maybe a little too harsh) so I will just write how it went. Maybe this helps someone facing the same issues.

I went down the route to finally set up STAS since static CSV imports will only lead to new / edited mailboxes missing down the line. I disabled anything possible in STAS (like block traffic and track logoff stuff) and did not care about the WMI stuff to the clients, as it turned out not to be neccessary to just get the live users into the XGS Open Group to finally enable Quarantine Digests.

STAS works fine so far and it is nice that STAS created users will stay in XGS, I simply set quarantine digests to hourly and the digest also lists every mail that went to quarantine since the XGS is running at the customer so nothing is missing there. Login to UserPortal is working fine and users can do self service if they manage to do so by themselves.

I had to create 25 additional shared mailboxes by hand, I created another Shared-User group to kinda keep some sort of overview, that works as well and that of course is something the customer and I have to keep track of, but that is manageable. they have about 2 new users with mailbox a week on average but not a lot of rotation with shared mailboxes.

Thanks a lot LuCar Toni to clearly state my options and to state where the limitations of XGS Email Protection are and what the alternative is (CEMA). Great help as always in this forum and sorry for directly mentioning your name in the beginning, you just wrote how Sophos does it, was wrong to mentioning your name, wasnt meant personal. Dont shoot the messenger..

Have a nice day.

The issues are now resolved as far as it is possible for me in this scenario and we will look into migrating to Central Mail Protection (or some alternative product for OnPrem) in time when the XGS EMail Protection runs out and we would need a renewal. If the custome ris happy with how it is, I will keep it this way, lets see how it goes from here.

I already stated what I think of Sophos approach (maybe a little too harsh) so I will just write how it went. Maybe this helps someone facing the same issues.

I went down the route to finally set up STAS since static CSV imports will only lead to new / edited mailboxes missing down the line. I disabled anything possible in STAS (like block traffic and track logoff stuff) and did not care about the WMI stuff to the clients, as it turned out not to be neccessary to just get the live users into the XGS Open Group to finally enable Quarantine Digests.

STAS works fine so far and it is nice that STAS created users will stay in XGS, I simply set quarantine digests to hourly and the digest also lists every mail that went to quarantine since the XGS is running at the customer so nothing is missing there. Login to UserPortal is working fine and users can do self service if they manage to do so by themselves.

I had to create 25 additional shared mailboxes by hand, I created another Shared-User group to kinda keep some sort of overview, that works as well and that of course is something the customer and I have to keep track of, but that is manageable. they have about 2 new users with mailbox a week on average but not a lot of rotation with shared mailboxes.

Thanks a lot LuCar Toni to clearly state my options and to state where the limitations of XGS Email Protection are and what the alternative is (CEMA). Great help as always in this forum and sorry for directly mentioning your name in the beginning, you just wrote how Sophos does it, was wrong to mentioning your name, wasnt meant personal. Dont shoot the messenger..

Have a nice day.