Page Comparison

Sophos have advised that after the Big Sur/macOS 11 upgrade, Sophos background scanning on Macs may stop running.

Sophos are also reporting when upgrading from macOS 14/Sonoma to macOS/15 Sequoia, Apple may trigger a full disk access requirement for the Sophos Updater to update the Sophos files on the system. This was intermittent on Sonoma, but has increased significantly on Sequoia. Note: Sequoia is not officially supported by Sophos Endpoint prior to version 2024.3 (10.9.1) https://support.sophos.com/support/s/article/KBA-000009916?language=en_US

To check this, if you open the Sophos Endpoint console & you see the error below, your Sophos scanning has stopped working.

This is due to a change in the way the operating system runs which now requires permissions, so you may get prompted to update the “Full Disk Access” permissions for the scanning extension.

So if you see the error above, you can fix it by following these steps:

1. On the Mac, open System Settings (formerly known as System Preferences).

Image Added

2. Select Privacy and Security.

Image Added

3. Scroll down to the option Security and check if there is a prompt "Some system software requires your attention before it can be used".

Image Added

4. Select Details and provide your credentials when prompted.

Image Added

6. Select the toggle to turn on SophosScanD and Sophos Network Extension.

Image Added

7. Select Allow when prompted " Sophos Network Extension Would Like to Filter Network Content".

Image Added

8. Go back to Privacy and Security in System Settings again

Image Added

9. Select Full Disk Access

Image Added

10. Select the

10. com.sophos.endpoint.scanextension, even if it is toggled on, and click the minus sign at the bottomto remove it from the list.

Image Added

11. Wait a minute, and the Sophos Endpoint scan extension should automatically re-appear in the list.

12. Select the toggle switch to turn on Full Disk Access.

For additional help, you can watch this video to see a quick demo of the steps above:

https://techvids.sophos.com/share/watch/nBgBgc6cTjEBwfL2waXpEa?

Alternative method if the above does not work via Sophos Endpoint

1. Open Sophos Endpoint on the end user's Mac

2. From the Apple Menu bar go to About Sophos Endpoint

   Image Added

    

3. Run the diagnostic tool from the screen that shows up
   

   Image Added

    

4. When on a device that needs this applied you’ll see a screen like this
   

   Image Added

    

5. Click and follow the instructions to allow full disk access by dragging the Sophos icon into the full disk access list
   

   Image Added

6. Quit and re-open Sophos.