Skip to content

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/central/customer/help/en-us/index.html?contextId=sophos-email-monitoring-system-features

Supported EMS features

The table below lists the features supported by Sophos EMS.

Feature Sophos EMS Sophos Email Advanced
Email protection Monitoring and visibility only. Full threat protection.
Email flow mechanism Scans journaled email copies. No impact on delivery. Scans live email traffic via Gateway or Microsoft 365 mailflow.
Email policy actions Policy actions are for reference only. Emails are scanned as copies and not modified. Policy actions are applied.
Content-based detections Flags sensitive content in reports. Policy action isn't enforced. Enforced.
Encryption Not supported. EMS is used for monitoring only. Supported.
Time of Click protection Shows URL verdicts but doesn't rewrite links. Supported.
Manual clawback Supported. Admins can claw back delivered messages. Supported.
Post-delivery auto search and remediate Not supported. EMS doesn't take action after delivery. Supported.
Post-delivery quarantine Lists only manually clawed-back messages. Lists both manually and automatically clawed-back messages.
Quarantined messages Quarantined messages are for reference only. Sophos doesn't hold back the messages because they're journal copies. Quarantined messages are held back.
Self Service Portal Not available to users. EMS doesn't apply user actions. Available to users.
Logging and reporting Logs all verdicts for visibility and MDR/XDR. Logs verdicts, actions, and policy results.