Sophos have advised that after the Big Sur/macOS 11 upgrade, Sophos background scanning on Macs may stop running.
To check this, if you open the Sophos Endpoint console & you see the error below, your Sophos scanning has stopped working.
This is due to a change in the way the operating system runs which now requires permissions, so you may get prompted to update the “Full Disk Access” permissions for the scanning extension.
So if you see the error above, you can fix it by following these steps:
On the Mac, open System Settings (formerly known as System Preferences).
Select Privacy and Security.
Scroll down to the option Security and check if there is a prompt "Some system software requires your attention before it can be used".
Select Details and provide your credentials when prompted.
Select the toggle to turn on SophosScanD and Sophos Network Extension.
Select Allow when prompted " Sophos Network Extension Would Like to Filter Network Content".
Go back to Privacy and Security in System Settings again
Select Full Disk Access
Select the com.sophos.endpoint.scanextension, even if it is toggled on, and click the minus sign at the bottom to remove it from the list.
Wait a minute, and the Sophos Endpoint scan extension should automatically re-appear in the list.
Select the toggle switch to turn on Full Disk Access.
Alternative method if the above does not work via Sophos Endpoint
Open Sophos Endpoint on the end user's Mac
From the Apple Menu bar go to About Sophos Endpoint
Run the diagnostic tool from the screen that shows up
When on a device that needs this applied you’ll see a screen like this
Click and follow the instructions to allow full disk access by dragging the Sophos icon into the full disk access list
Quit and re-open Sophos.
For additional help, you can watch this video to see a quick demo of the steps above:
https://techvids.sophos.com/share/watch/nBgBgc6cTjEBwfL2waXpEa?If you need help with doing this, then please contact the CSCS Service Desk for further assistance
For reference:
More information on the issue can be found via this Sophos article https://support.sophos.com/support/s/article/KB-000039501?language=en_US