Skip to content


The Alerts page lists the alerts that require your attention.

For each alert, the list shows the event that caused the alert, when it occurred, and which user and device are affected.

The list also shows the severity of alerts:

  • Info Gray info sign for informational alerts
  • Medium Orange warning sign for medium-priority alerts
  • High Red warning sign for high-priority alerts

Acknowledge alerts

Select one or more alerts and then click Mark as acknowledged to remove the selected alerts from the list. To display acknowledged alerts, select Show acknowledged alerts in the drop-down list above the table.


Acknowledging an alert does not resolve the event that triggered it.


Alerts are automatically deleted from the Sophos Mobile database after 90 days, even if you have not acknowledged them.

Set up email reports for alerts

Sophos Mobile sends email reports for all alerts that have not been acknowledged yet. For information on how to set up the list of recipients and the notification schedule, see Configure Email.

Which events trigger alerts?

Alerts are created for the following events:

  • Compliance violations for which you’ve turned on the Create alert action.
  • Device lifecycle changes and important device actions.
  • Upcoming expirations of licenses and certificates.
  • Other events requiring your attention.

If Sophos Intercept X for Mobile is managed by Sophos Mobile, it creates alerts for security issues and blocked web pages.

Back to top