Skip to content

Control updates manually

You can control product updates manually.


You can control updates on Windows and Linux devices, but not Macs.

This stops automatic updating so that you can decide when to test new product versions and roll them out to your computers.


Your computers will still get automatic security updates.

This Help topic tells you how to set up manual updating, and how to test and roll out updates.

How to set up manual updating

Go to Global Settings > Controlled Updates, click Control Updates Manually.


This stops all automatic updates. You are not asked for confirmation.

Initially, your situation is this:

  • All your computers are on the Newest (recommended) version. They'll be shown as being on this version until Sophos issues a newer version.
  • No computers will get any further updates until you update them.

Now you should set up test computers (if you want to).

Set up test computers

You can use test computers to try out new versions.

  1. In the Test computers table, click Add.
  2. Select computers from the Available Computers list.

You’re now ready to test updates and roll them out manually.

Test and roll out updates

When Sophos releases a new product version:

  • You receive an email alert.
  • Computers that were on the Newest (recommended) version are now shown as being on the Oldest.

In the table of versions, you can use the buttons in the Action column to update computers when you want to.

Typically, you would want to test the new version on selected computers and then roll it out to all the other computers.

In the Action column, next to Test Computers, click Update test computers to newest version.

When you’re ready to update all your other computers, in the Action column, next to Non-test computers, click Update to match test computers.

This forces the non-test computers to update. A computer updates automatically when it receives the policy update. Note that this update follows any schedule that you’ve set in the Update Management policy for servers and endpoints.

Why can I see a 'Previous' version now?

If Sophos releases another product update when you already have test computers on Newest (recommended) and the rest on Oldest:

  • Test computers are now shown as being on the Previous version (the version that has just been replaced by a newer one).
  • Non-test computers are on Oldest.

You can use an action button next to the test computers to Update test computers to newest version.

You can use an action button next to non-test computers to Update to match test computers.

What happens when a version expires?

Sophos product updates expire after 90 days. When the Oldest version expires, computers are forced to update as follows:

  • If all computers are on Oldest, they resume automatic updating.


    If this happens, all computers get the newest version. You no longer control updates manually.

  • If non-test computers are on Oldest, but test computers are on a newer version, the non-test computers are updated to the same version as the test computers.

Back to top