About macOS policies

Declarative policies might not be available for all customers yet.

You can assign the following policies to a Mac:

Device policy: When you assign a device policy to a Mac, the settings apply to all users who sign in to the Mac. See Configurations for macOS device policies.
Declarative policy: A declarative policy is a type of device policy that uses Apple's modern declarative device management feature. See About Apple declarative device management.
User policy: When you assign a user policy to a Mac, the settings apply to the following users:
- The local user that has enrolled the Mac with Sophos Mobile.
- All network users that are known to Sophos Mobile, that is, users from the external LDAP directory that you configured for Sophos Central Self Service Portal.
See Configurations for macOS user policies.
Imported policy: You can import Apple configuration profiles you downloaded from Sophos Central to configure Sophos Endpoint on your Macs. See Download the macOS configuration profiles.

You can also import profiles you created in Apple Configurator or obtained from trusted third-party sources.

For details on importing configuration profiles to Sophos Mobile, see Import Apple configuration profiles.

Note the following differences between device policies, declarative policies, and user policies:

In addition to the enrollment policy (which is a device policy), you can assign one device policy, one declarative policy, and one user policy to a Mac.
If there are conflicting settings in the policies applied to a device, the system uses the most restrictive setting. There's one exception: Software update and app configuration settings in a declarative policy take precedence over the corresponding settings in a device or user policy.
On the Mac, the assigned policies are listed under System Preferences > Profiles.
When you update a device policy or a declarative policy, the changes take effect the next time the device syncs.
When you update a user policy, the changes take effect the next time a user logs in to the Mac.
Users may remove the user policy from the Mac but it is automatically re-assigned the next time the user logs in.
Users can’t remove the device policy or the declarative policy.
When a user removes the enrollment policy, the Mac is unenrolled from Sophos Mobile. This requires administrator privileges.