Sophos Mobile

Apple declarative device management

We added Apple declarative device management (DDM) policies to Sophos Mobile.

Apple declarative device management is Apple's modern protocol for mobile device management. With DDM, you set a desired device status, and the device is responsible for reaching and maintaining that status. The device reports changes immediately and Sophos Mobile can respond without waiting for the next periodic synchronization.

For details, see About Apple declarative device management.

Web Filtering

We improved the instructions on the Web Filtering pages of Mobile Threat Defense policies for Android and iOS and the Chrome Security policy for ChromeOS.

Now, the instructions clearly advise not to include protocol prefixes such as https:// or chrome:// in the Allowed domains and Blocked domains fields. We also added more examples of valid entries.

Apple "Single sign-on" configuration

Apple has deprecated the Single sign-on configuration of iOS device and user policies. The next iOS and iPadOS versions, iOS 27 and iPadOS 27, will no longer support the configuration.

New Password services configuration

We added a Password services configuration to Android Enterprise device and work profile policies. This configuration lets you restrict the use of password managers. You can configure a list of apps that provide a password management service, and then either allow these apps and block all others, or block these apps and allow all others.

CalDAV and CardDAV configurations

We increased the character limits of several input fields in the CalDAV and CardDAV configurations of iOS and macOS policies, including the Principal URL field. In the past, some exceptionally long principal URLs exceeded the field's character limit.

Apple Business profiles

We added a Don't use MDM policy from backup setting to the Enrollment tab of Apple Business profiles for iOS and iPadOS.

When you set up a device using a backup that includes the Sophos Mobile enrollment profile, the device tries to reconnect to Sophos Mobile during setup. However, if you've already removed the device from Sophos Mobile, Sophos Mobile rejects the connection. To avoid this issue, turn on Don't use MDM policy from backup, then assign the updated profile to the device before resetting it.

This setting only applies to devices running iOS 26 and iPadOS 26. Devices running iOS 27, iPadOS 27, or later never restore the enrollment profile from a backup.

Apple policies

We added a version label to some restrictions related to Apple software updates to indicate that they don't apply to devices running Apple's upcoming OS versions, iOS 27, iPadOS 27, and macOS 27. For these devices, there will be equivalent settings in new declarative policies we'll make available soon.

This change affects the following settings of the Restrictions configuration:

• iOS & iPadOS device policy:
  • iOS & iPadOS software update delay
  • Turn on Rapid Security Response
  • Allow removal of Rapid Security Response update
• macOS device policy:
  • macOS software update delay
• macOS user policy:
  • macOS software update delay

Supported device platforms

We added support for Android 17.

Apple Business Manager

We replaced all references to Apple Business Manager with Apple Business.

Apple has renamed their Apple Business Manager offering to Apple Business, which combines the capabilities previously provided by Apple Business Manager, Apple Business Essentials, and Apple Business Connect.

To find out more about Apple Business, see this Apple Newsroom article.

Android restrictions

We added a tooltip to the Allow Android Beam Android restriction to clarify that Android Beam is only available in Android 9 and earlier, and that the restriction doesn't apply to other sharing technologies such as Quick Share.

Web Clip URL handling

We improved the handling of Web Clip URLs in iOS and macOS policies. URLs that don't explicitly include a protocol, such as https://, are now handled correctly, reducing configuration errors.

iOS profile signing

We switched the signing certificate for iOS and macOS enrollment profiles to an Apple MDM Vendor certificate. Note that the new certificate shows a different signer name than the old one.

Calendar widgets

We replaced all date pickers and calendar widgets with PrimeFaces components to provide a more consistent user experience.

Cisco Duo integration

We removed the option to add a Duo device certificate configuration to iOS device policies because Duo no longer supports the SCEP-based integration.

Existing policies don't change.

For policies you created in Sophos Mobile, we ignore the Duo device certificate configuration when assigning the policy to a device. For policies you imported to Sophos Mobile, you must delete any Duo device certificate configuration manually.

Windows restrictions

We added the Forbid resetting the computer restriction to Windows device policies. When you turn this setting on, users can't reset the computer to its factory settings from Settings or the Windows Recovery Environment (Windows RE).

Managed Google Play apps

On the Edit approved app page, we removed the link to the app's page in managed Google Play. Google will retire the https://play.google.com/work website on May 15, 2026, because it has become obsolete.

You can still access an app's page in managed Google Play by going to Apps > Android > Open managed Google Play.

Tasks

We adjusted the internal handling of delayed tasks to improve the overall system performance.

User interface

We updated the Sophos Mobile user interface styling to align with the Sophos Central experience.

Mobile API

We improved the error message that you get when you try to create more than the maximum possible number of tasks or other items through the Mobile API.

iOS and iPadOS restrictions

We added a note to the relevant fields in the iOS and iPadOS device policies, explaining the impact of app usage restrictions on built-in apps. Specifically, when you configure a list of allowed apps, you must add com.apple.Sharing.AirDropUI to allow inbound AirDrop connections, and com.apple.webapp to allow Web Clips.

Apps groups

We simplified app group creation by adding a Get data button to the Add app dialog. This button lets you automatically get the app details from the relevant app store. Specifically, this button is helpful for users with an Intercept X for Mobile license, where adding apps already configured in Sophos Mobile isn't available.

TeamViewer device action

We renamed the device action to start a TeamViewer session from Request remote control to Start TeamViewer session because not all devices allow full remote control.

APNs certificates

We improved the password creation for Apple Push Notification service (APNs) certificates by avoiding ambiguous characters such as l and 1. This reduces the risk of errors when the password is read and entered manually.

User interface improvement

We improved the user experience by optimizing browser caching of UI resources.

Assign imported macOS configuration policies

You can now select imported macOS policies in the Assign policy dialog available from the device list. This allows you to assign policies to multiple devices at once.

Table exports

We've limited the number of entries you can export from a table to 5,000. If a table has more than 5,000 entries, the options to download the whole table as a CSV or Microsoft Excel file aren't available.

We recommend using reports or the Mobile API instead. For large amounts of data, these methods are significantly faster than exporting entries from a table.

Email placeholder for managed configurations

We added a setting Use the assigned user's email address to the Android Enterprise setup page. This setting controls the behavior of the $EMAILADDRESS placeholder in managed configurations of Android apps.

• When you select Use the assigned user's email address, Sophos Mobile replaces $EMAILADDRESS with the email address of the user assigned to the device in Sophos Mobile. When the user changes, installed apps update the email address the next time the device synchronizes with Sophos Mobile.
• When you clear Use the assigned user's email address, Sophos Mobile replaces $EMAILADDRESS with the email address used for enrolling the device with Sophos Mobile.

New macOS restriction

We added the Allow Erase All Content and Settings restriction to macOS device and user policies. When you turn this setting off, users can't use Erase All Content and Settings in the macOS system settings to erase all settings, data, and apps on their device.

This setting only applies to Macs with Apple silicon or Apple T2 Security Chip.

Supported device platforms

• We added support for Android 16.
• We added support for iOS and iPadOS 26 and removed support for iOS and iPadOS 15.
• We added support for macOS 26 (Tahoe) and removed support for macOS 11 (Big Sur).

User interface improvements

We improved the naming of the following user interface elements:

• On the Privacy tab of the General settings page, we renamed the Executed by filter to Account type.
• In the Wi-Fi configuration of iOS and macOS device and user policies, we renamed the External identity setting to Outer identity.
• On the User setup tab of the Sophos setup page, we renamed the Unenroll and delete device option to Delete device.

Policy import

We improved the error message when you import a policy with the same ID as an existing policy.

Apps

We removed the option to download app packages from Sophos Mobile because the feature was rarely used. This change doesn't affect installing apps on devices.

Privacy log

We improved the filter settings on the Privacy tab of the General settings page. Some filters contained an Unknown option, which never showed any log entries.

New iOS device policy restrictions

We added the following settings to the Restrictions configuration of iOS device policies:

• Allow clearing Safari history: When you turn this setting off, the Clear History and Website Data option in Safari is unavailable.
• Allow Safari Private Browsing: Users can use Safari's Private Browsing feature.

New Android Enterprise kiosk mode setting

We added the Show system information in status bar setting to the Kiosk mode configuration of Android Enterprise device policies. Turn this setting on to show system information indicators in the status bar, such as time, connectivity, and battery level.

New Apple Business Manager profile settings

We added the following settings to Apple Business Manager profiles:

• Multitasking (iOS, iPadOS)
• OS Showcase (iOS, iPadOS)
• Additional Privacy Settings (macOS)

These settings let you skip the setup assistant's respective configuration page.

Android Enterprise QR code and zero-touch enrollment

We added a Use cellular network configuration setting for Android Enterprise QR code enrollment and zero-touch enrollment.

For details, see Set up QR code enrollment and Set up zero-touch enrollment.

iOS app links

We improved the validation of the App ID field for iOS app link configurations to prevent installation issues.

Global HTTP proxy configuration

We improved the validation of the Server and Port fields in the Global HTTP proxy configurations of iOS device policies, macOS device policies, and macOS user policies.

User Activity Verification

The User Activity Verification feature, which lets you request information from users on their mobile devices, is now turned on by default.

For details on User Activity Verification, see the help.

New iOS restrictions

We added the following restrictions to iOS device policies:

• Allow changing the default calling app: If you turn this setting off, users can't change the default calling app.
• Allow changing the default messaging app: If you turn this setting off, users can't change the default messaging app.
• Allow Smart Reply in Mail: Users can use the AI-powered Smart Reply feature in the Mail app to reply to an email.
• Allow Notes transcription: Users can use Apple Intelligence to transcribe audio recordings in the Notes app.
• Allow Notes transcription summary: Users can use Apple Intelligence to summarize audio recordings in the Notes app.
• Allow Summarize in Safari: Users can use the AI-powered Summarize feature in Safari to summarize web pages. If you turn this setting off, users can still use Writing Tools to summarize text they select in Safari.
• Allow visual intelligence summaries: Users can use visual intelligence to summarize text they photographed with the device camera.
• Allow Apple Intelligence Report: If you turn this setting off, users can't generate the Apple Intelligence Report, which shows the requests the device has sent to Private Cloud Compute.

Android Factory Reset Protection

We improved the validation of Google+ IDs you enter on the Google setup page to configure the Android Factory Reset Protection feature. You can no longer accidentally enter an email address instead of an ID.

New iOS restrictions

We added the following restrictions to iOS device policies:

• Allow satellite connections: Users can connect to satellite services.
• Allow changing the default browser app: If you turn this setting off, users can't change the default browser app.
• Allow external Apple Intelligence integrations: Users can use third-party, cloud-based intelligence services with Siri.
• Allow signing in to external Apple Intelligence integrations: If you turn this setting off, users can only use third-party intelligence services with Siri in anonymous mode.

New "Software update" configuration for macOS

We added a Software update configuration to macOS device policies. This configuration lets you manage macOS system settings for software updates.

For details, see the help.

macOS app installation configuration

We removed the Require admin password setting from the App Store configuration of macOS user policies because Apple no longer recommends using it.

Instead, use the Require admin password for app installations setting in the new Software update configuration of macOS device policies.

iOS and macOS Wi-Fi configuration validations

We improved the validation of the TLS minimum version, TLS maximum version, and External identity fields in the Wi-Fi configurations of iOS and macOS device and user policies.

TeamViewer integration

We improved the TeamViewer setup page to better describe the actions admins can perform during a TeamViewer remote session.

Revoking Apple VPP registration

We added a warning to the dialog for revoking a user's VPP registration. The warning explains that if the user has enrolled an iPhone or iPad in Apple User Enrollment management mode, you can no longer install apps on that device via Sophos Mobile.

macOS configuration profiles in task bundles

You can now use the Assign imported policy task in macOS task bundles to assign Apple configuration profiles you imported to Sophos Mobile.

Kernel extension policy

We removed the Kernel extension policy configuration from macOS device policies. This configuration only applies to macOS 10.15 Catalina and earlier, which Sophos Mobile doesn't support.

Apple Business Manager profiles

We added settings to Apple Business Manager profiles that let you skip the correspondent page in the setup assistant.

This setting applies to iOS, iPadOS, and macOS:

• Apple Intelligence

These settings apply to iOS and iPadOS only:

• Lockdown Mode
• Web Content Filtering
• Camera Control

Android restriction

We improved the tooltip of the Allow app uninstall restriction to clarify that this setting also prevents administrators from uninstalling apps via Sophos Mobile.

Windows apps

We had to remove the Get data button from the Edit Windows app page because Microsoft removed the underlying API. We replaced this button with the Get Store ID button, which lets you fill in the Store ID automatically.

For information on how to get the app properties you previously could fill in with Get data, see Get Windows app properties.

Intercept X for Mobile enrollment configuration

We added a note to the Intercept X and Intune MTD tabs of the Sophos setup page explaining that you can only configure one of these tabs at a time.

macOS configuration profiles

You can now assign imported macOS configuration profiles using the Assign policy action on a Mac's Show device page.

New iOS restrictions

We added the following restrictions to iOS device policies:

• Allow call recordings: Users can record phone calls and view the transcript in the Notes app.
• Allow locking apps: When you turn this setting off, the following commands to lock an app aren't available in its quick actions menu:
  • Require Face ID
  • Require Touch ID
  • Require Passcode
• Allow hiding apps: When you turn this setting off, the following commands to hide an app aren't available in its quick actions menu:
  • Hide and Require Face ID
  • Hide and Require Touch ID
  • Hide and Require Passcode
  Hiding an app moves it to the Hidden folder in the App Library and requires Face ID, Touch ID, or the passcode to open it.
• Allow summarizing emails: When you turn this setting off, the Summarize command in Mail isn't available. This command uses Apple Intelligence to summarize an email message or thread.
• Allow RCS: Users can send messages via RCS (Rich Communication Services).

Read more

Intercept X for Mobile enrollment

You can enroll Intercept X for Mobile with Sophos Mobile using the same QR code for all your Android devices, iPhones, and iPads.

Because the QR code doesn't contain information about a Sophos Mobile user, devices enrolled with it don't have a user assigned. You can assign a user after enrollment.

See Enroll Intercept X for Mobile with a static QR code.

"Allow managing Google accounts" Android restriction

In Android Enterprise device policies, the Allow managing Google accounts restriction is only available when you turn on Allow managing accounts.

When Allow managing accounts is turned off, this also affects Google accounts.

CSV injection prevention

We enhanced the CSV export from Sophos Mobile to mitigate security risks when opening exported files in spreadsheet applications that support active content.

Input limitations

For performance reasons, the following input fields have a limit of 5,000 entries and 130,000 characters:

• The Allowed domains and Blocked domains fields in the Web Filtering configuration of Mobile Threat Defense policies for Android and iOS, and Chrome Security policies.
• The Allowed URLs and Blocked URLs fields in the Web content filter configuration of iOS device policies.
• The Email domains and Web domains fields in the Managed domains configuration of iOS device policies, macOS device policies, and macOS user policies.
• The Domains in Safari, Domains in Calendar, Domains in Contacts, and Domains in Mail fields in the Per app VPN configuration of iOS device policies and iOS user policies.

Apple User Enrollment with the "Add device" assistant

We adjusted the version information in the Add device assistant for profile-based Apple User Enrollment.

Profile-based Apple User Enrollment requires iOS 17, iPadOS 17, or earlier.

Windows MSI apps

We improved the validation of installation options you enter for Windows MSI links.

Windows Mobile support

Although Windows Mobile support ended on December 31, 2019, some features were still available to customers who enabled the Windows Mobile platform in Sophos Mobile before that date.

We'll soon remove the following features from Sophos Mobile:

• Add Windows Mobile devices, apps, and policies.
• Enroll Windows Mobile devices in Sophos Central Self Service Portal.

Apple Business Manager apps

We improved the automatic update of apps on Apple Business Manager iPhones and iPads. When you turn on Automatically update iOS VPP apps on the Apple VPP setup page, not only device-assigned apps on devices with Apple Device Enrollment management mode are automatically updated, but also user-assigned apps on devices with Apple User Enrollment management mode.

Sophos container feature removal

Following the Sophos container end of life in December 2023, we're now deleting all Sophos Secure Workspace work documents you uploaded to Sophos Mobile.

We removed the option to highlight compliance policies relevant to the Sophos container management mode from the Edit compliance policy page.

Importing macOS configuration profiles

You can now import Apple configuration profiles you created in Apple Configurator or got from other sources to install them on Macs.

Read more

Android kiosk mode settings

We added a tooltip to the Allow volume change setting of the Kiosk mode configuration of Android Enterprise device policies. The tooltip explains that the device is muted when the setting is turned off.

Sophos container feature removal

Following the Sophos container end of life in December 2023, we're now removing the following features from Sophos Mobile:

• Adding work documents
• Updating existing work documents
• Creating Android and iOS container policies

We'll be deleting existing work documents from all accounts soon.

Supported device platforms

• We added support for Android 15 and removed support for Android 8.
• We added support for iOS and iPadOS 18 and removed support for iOS and iPadOS 14.
• We added support for macOS 15 (Sequoia) and removed support for macOS 10.15 (Catalina).

Supported mail servers

We removed support for the Zimbra mail server.

New iOS restrictions

We added the following restrictions to iOS device policies:

• Allow app installation from a website: Users can install apps from a website.
• Allow iPhone mirroring on Macs: Users can use iPhone Mirroring on a Mac to control their device.
• Allow video conferencing remote control: In FaceTime calls, users can allow another user to control their device via SharePlay Remote Control.
• Allow Live Voicemail: If you clear the checkbox, Live Voicemail is unavailable.
• Preserve eSIM on erase: The eSIM is preserved when the device is erased with the Erase All Content and Settings action or when an incorrect password is entered too many times.
• Allow eSIM transfer to another device: Users can transfer their eSIM to another device.
• Allow automatic dimming: If you clear the checkbox, the automatic dimming of iPads with OLED displays is turned off.
• Allow Genmoji: Users can use the AI-powered Genmoji feature to create custom emojis by typing a description.
• Allow Image Wand: Users can use the AI-powered Image Wand feature to create images from sketches and text in their Notes app.
• Allow Image Playground: Users can use the AI-powered Image Playground feature to create images.
• Allow Writing Tools: Users can use the AI-powered Writing Tools feature to create, proofread, rewrite, or summarize text.
• Allow output in user’s handwriting: Users can use Apple Intelligence to create content in their own handwriting.

Read more

New Android restrictions

We added the following restriction to Android Enterprise device policies and work profile policies:

• Allow sharing of managed Wi-Fi connections: If the checkbox is cleared, users can’t share Wi-Fi connections configured by Sophos Mobile.

Read more

Account-driven Apple User Enrollment

You can now use account-driven Apple User Enrollment to enroll iPhones and iPads owned by your users. Account-driven Apple User Enrollment is more streamlined than the old profile-based Apple User Enrollment because the workflow is built into the device’s Settings app.

Account-driven Apple User Enrollment is available for iOS and iPadOS 15 and later. Profile-based Apple User Enrollment is available for iOS and iPadOS 17 and earlier.

Read more

Android 15

A known issue in preview versions of Android 15 prevents devices from being enrolled with Sophos Mobile or other Mobile Device Management (MDM) software. If this issue persists after the release of Android 15, enrollment tasks will fail with the following error: The enrollment type of the device doesn't support the selected action (error -115).

Sophos Chrome Security

We released a new version of Sophos Chrome Security, our Sophos Mobile client on Chromebooks. This version, 2.0.2218, requires ChromeOS 110 or later, which has been available since January 2023.

Windows Home support

Microsoft has removed Windows Home from its list of Windows editions that support device management through Mobile Device Management (MDM) solutions, such as Sophos Mobile. To manage a Windows computer with Sophos Mobile, Windows Enterprise, Education, or Pro must be installed. For details on supported versions, see the Requirements tab.

Chromebook Data Lake uploads

The Chromebook data we upload to the Sophos Data Lake now includes information about app installation sources. You can already access the new data through our XDR Query API. Over the next releases, we'll add queries in Live Discover that take advantage of the new data.

For information about the XDR Query API, see Getting Started with XDR Query and the Mobile schema documentation.

Android password restrictions

With Android 12, Google has simplified the configuration of password complexity requirements to unlock the display. The Password policies - Device configuration of Android Enterprise work profile policies now has a Minimum password complexity list that lets you choose from three levels, Low, Medium, and High, each with fixed complexity rules.

Read more

Find devices

When finding devices is disabled in the Sophos Mobile privacy settings, the Find device action is disabled instead of removed and shows a tooltip with information about how to enable it.

Improved user experience

The Install app button on the Installed apps tab of the Show device page is highlighted to improve its visibility.

EAS proxy

We removed the Restrict to Sophos Secure Email setting from the EAS proxy configuration.

Support for Sophos Secure Email ended in December 2023. Some features still work, but we'll remove them step by step over the next weeks.

Improved user experience

The following buttons are now highlighted to improve their visibility:

• The Install app button on the Installed apps tab of the Show device page for Android devices.
• The Download certificate signing request button on the CSR page of the APNs certificate wizard.

Work documents

The Sophos Secure Workspace apps for Android and iOS can no longer download work documents from Sophos Mobile.

Support for Sophos Secure Workspace ended in December 2023. Some features still work, but we'll remove them step by step over the next weeks.

New Android Enterprise registration mode

If you registered your organization with Android Enterprise before April 9, 2024, you had to choose between the Managed Google Play Account and the Managed Google Domain registration mode. If you register after that date, there’s only a single registration mode, Better Together Enterprise.

Read more

Android Enterprise device policies

We removed the Enable USB storage restriction from Android Enterprise device policies. This restriction only applies to legacy devices that Sophos Mobile no longer supports.

iOS device policies

We removed the supervised label from the Allow use of camera restriction of iOS device policies. Supervised and non-supervised devices support this restriction.

iOS device policy

We added the Allow alternative app marketplace setting to the Restrictions configuration of iOS device policies. When you turn the setting off, users can't install alternative app marketplaces, and any alternative app marketplace already installed is disabled.

Apple Business Manager profiles

In an Apple Business Manager profile, you can now configure more pages to be skipped by the iOS or macOS setup assistant. These pages are as follows:

• Safety
• Accessibility
• Term of Address
• Software Update Complete
• Get Started
• Restore Completed
• App Store
• Lockdown Mode
• Wallpaper

Some settings only apply to either iOS or macOS. For details, see the help pages for iOS profiles and macOS profiles.

Compliance policies

We removed the Apps from unknown sources allowed compliance rule for Android devices. This rule only applies to devices with Android 7.1 or earlier, which aren't supported anymore.

Supported macOS versions

We added support for macOS 14 (Sonoma) and removed support for macOS 10.14 (Mojave).

Sophos container end of support

Support for the Sophos container, including the Sophos Secure Email and Sophos Secure Workspace container apps, has ended. We encourage you to transition to Android Enterprise work profile enrollment and Apple User Enrollment, which are the Android and iOS equivalents of the Sophos container.

macOS policy changes

We added the following settings to the Restrictions configuration of macOS device and user policies:

• Allow Time Machine configuration
• Allow Startup Disk configuration
• Allow Bluetooth Sharing configuration
• Allow iCloud for Freeform
• Allow fingerprint configuration
• Allow File Sharing configuration
• Allow Internet Sharing configuration
• Allow Printer Sharing configuration
• Allow Remote Application Scripting configuration
• Allow Remote Management configuration
• Allow adding users

For details, see the help.

Reports

We added a Security Patch Level column to the Device inventory report. For Android devices, the column shows the version of the installed security update.

TLS version for device connections

Devices must use TLS 1.2 when connecting to Sophos Mobile. TLS 1.1 connections are rejected. This change only affects legacy device operating systems we don't support anymore.

iOS policy changes

• Added the Connect on demand automatically setting to the Per app VPN configuration of iOS device and user policies.
  When turned on, the device automatically starts the VPN when apps assigned to the VPN connect to the network. When turned off, the user must start the VPN.
• Added the Force local translation setting to the Restrictions configuration of iOS device and user policies.
  When turned on, the device doesn’t connect to Siri servers for translations.
• Added the following settings to the Restrictions configuration of iOS device policies:
  • Allow changing cellular plan settings: Users can change settings related to their cellular plan.
  • Allow Personal Hotspot: Users can modify Personal Hotspot settings.
  • Allow iCloud Private Relay: Users can use iCloud Private Relay.

  These three settings only apply to supervised devices.

Certificates in policies

You can now add two or more certificates with the same Common Name (CN) to a policy. Previously, Sophos Mobile rejected the second certificate as a duplicate. The changed behavior applies to root and client certificates.

For example, when you renew a certificate, you can add both the old and the renewed certificate to your policy.

iOS device policies

Added a new Allow iPhone widgets on Mac setting to the Restrictions configuration of iOS device policies. When you turn this setting off, users can’t use widgets from their iPhone apps on their Mac.

Windows kiosk mode

Added a note to the Kiosk mode configuration of Windows policies explaining that the kiosk app must be a Universal Windows Platform (UWP) app, not a Win32 app installed from an .msi file.

Dashboard widgets

Improved some widget titles on the Sophos Mobile dashboard to fit on a single line.

Android Wi-Fi configuration

We added the following settings to the Wi-Fi configuration of Android policies:

• Domain suffix match
• Subject alternative name match

On Android 11 and later with security updates released after April 2023, these settings are required for Wi-Fi connections that use the Extensible Authentication Protocol (EAP).

For details on using these settings, see Wi-Fi configuration (Android Enterprise device policy) and Wi-Fi configuration (Android Enterprise work profile policy).

ChromeOS synchronization interval

We removed the setting to configure the synchronization interval of the Sophos Chrome Security extension on ChromeOS devices.

ChromeOS devices use a fixed synchronization interval of 24 hours. For details, see Device synchronization.

User search in assistants

When you search for a user in the Add device, Assign user to device, or Invite users to VPP assistant, the user is automatically selected when there's only one match.

New menu look

We aligned the look of the Sophos Mobile menu with the new Sophos Central experience.

iOS 17 support

We added support for iOS 17 and iPadOS 17.

Improved user experience

We aligned the look of widgets on the Mobile dashboard with the main Sophos Central dashboard.

Mobile Threat Defense devices

We removed the Serial number property from the device details page of devices enrolled in Mobile Threat Defense management mode. For this management mode, devices don’t report their serial number to Sophos Mobile. The number shown was generated by Sophos Mobile for internal purposes.

Demo apps for trial licenses

We stopped adding the Sophos Secure Workspace and Sophos Secure Email apps to the demo data we create for trial licenses. As already announced, we’ll remove these apps from the app stores in December 2023 and won’t support them after this date.

Managed Google Play apps

We reduced the time it takes to send an installation task for a Managed Google Play app to Google. Note that after sending the task to Google, we can’t control when installation starts on the device.

User-less Android devices

The QR code and Zero-touch enrollment methods for Android Enterprise devices now support user-less devices such as kiosk devices.

User-less devices are Android Enterprise fully managed devices that you don’t connect with an email account during enrollment. Sophos Mobile doesn’t assign a user to the device.

Reset ActiveSync ID

We enhanced the Reset ActiveSync ID device action to allow resetting the ActiveSync ID Outlook device property. Previously, you could only reset the ActiveSync ID property.

ActiveSync ID is the ActiveSync ID sent by the native mail apps, Gmail on Android and Mail on iOS. ActiveSync ID Outlook is the ActiveSync ID sent by Microsoft Outlook.

Compliance rules

We removed the Google SafetyNet compatibility required compliance rule for Android devices. Google will discontinue the SafetyNet API soon.

Instead, Sophos Mobile apps use the Google Play Integrity API for checking device integrity. This feature is always active.

Windows Mobile

When we ended support for the Windows Mobile operating system in 2020, it was still available as a device platform in Sophos Mobile. Now, we’ve removed Windows Mobile from dashboard widgets and device filters.

Note that because Windows Mobile is not supported, managing Windows Mobile devices from Sophos Mobile might stop working without further notice. We recommend you delete any Windows Mobile devices still enrolled with Sophos Mobile.

Audit Log

We improved device deletion entries in the Sophos Central Audit Log to include the name of the account that did the deletion.

Compliance policies

We renamed the Maximum interval between synchronizations compliance rules for the different device platforms to include the type of synchronization the rule refers to.

For example, the Chromebook rule Maximum interval between synchronizations is now Maximum interval between Sophos Chrome Security synchronizations.

Web Filtering

The Web Filtering configuration page for iOS now has a note stating that web traffic from apps is also filtered and that you must not block domains any app depends on.

Supported software

We removed support for the following devices and mail servers:

• Android 7.0 and 7.1.
• Version 2004 (May 2020 Update) and earlier of Windows 10 Enterprise, Windows 10 Education, Windows 10 Pro, and Windows 10 Home.
• Exchange Server 2010 and 2013.

Policies

On the Email account pages of Android Enterprise policies, added a note that modern authentication with Gmail requires Google Chrome.

Web Filtering events

We reduced the volume of Web Filtering events for Intercept X for Mobile on iPhones and iPads by ignoring OS-level connections from iOS to Apple servers.

Device action: Set to “Not managed”

We removed the device action Set to “Not managed”. It was very rarely required and often used incorrectly. To remove a device when it loses its connection to Sophos Mobile, use the Delete action instead.

iOS apps

When you change the identifier of an iOS app after you added the app to Sophos Mobile, a new confirmation dialog will ask you to confirm the identifier.

Note that you can’t install the app if the identifier you enter in Sophos Mobile doesn’t match the value shown in iOS.

Apple Business Manager

In the Apple Business Manager profile settings for iOS, we renamed the options of the Assign user to device setting to make it more obvious which option to use.

• Yes - Basic authentication is now Yes - LDAPS authentication.
• Yes - Modern authentication is now Yes - Self Service Portal authentication.

You can hover over the options in Sophos Mobile for additional information.

Managed configuration for iOS and iPadOS apps

When you enter managed configuration settings for iOS or iPadOS apps, we automatically remove leading and trailing spaces and other whitespace characters. Apps might fail to read managed configuration if there’s extra whitespace. (SMCSRV-13729)

Access Point Name configuration

The Access Point Name (APN) configuration of iOS device policies doesn’t support iOS 16.0, iPadOS 16.1, or later. Use the Cellular configuration instead. The APN configuration hasn’t been recommended by Apple for some time and has now stopped working for the versions mentioned. (SMCSRV-13734)

Tasks

• We improved the layout of the Task details page. There's a new Task progress section showing the task's processing details. (SMCSRV-13694)
• To facilitate troubleshooting, failed tasks on the Tasks and Task archive pages now include a link to their Task details page. (SMCSRV-13696)

Log files

The confirmation dialog of the Get log files device action now shows the email address that receives the log files. (SMCSRV-13679)

Apple Business Manager

• The list of devices on the Apple DEP page now shows the profile status more prominently and highlights devices without an Apple Business Manager profile. (SMCSRV-13389)
• Sophos Mobile now uses your first Apple Business Manager profile as the default profile. Remember that you can change the default profile on the Apple DEP profiles tab of the Apple setup page. (SMCSRV-13390)

Extended device filter

You can now use the extended device filter to filter by external device ID. (SMCSRV-13650)

APNs certificate

When you renew an Apple Push Notification service (APNs) certificate, you can edit the email address field to reflect account changes you made in the Apple portal. (SMCSRV-13630)

iOS device policies

• You can now use the Web content filter configuration to filter the network traffic of individual apps on non-supervised iPhones and iPads. This requires iOS 16, iPadOS 16.1, or later. (SMCSRV-13486)
• The Restrictions configuration now contains a setting to turn off Mail Privacy Protection. This requires iOS 15.2, iPadOS 15.2, or later. (SMCSRV-13636)
• The Restrictions configuration now contains settings to configure and enforce Rapid Security Response updates. This requires iOS 16, iPadOS 16.1, or later. (SMCSRV-13635)