Sophos Mobile

EAS proxy

We removed the Restrict to Sophos Secure Email setting from the EAS proxy configuration.

Support for Sophos Secure Email ended in December 2023. Some features still work, but we'll remove them step by step over the next weeks.

Improved user experience

The following buttons are now highlighted to improve their visibility:

• The Install app button on the Installed apps tab of the Show device page for Android devices.
• The Download certificate signing request button on the CSR page of the APNs certificate wizard.

Work documents

The Sophos Secure Workspace apps for Android and iOS can no longer download work documents from Sophos Mobile.

Support for Sophos Secure Workspace ended in December 2023. Some features still work, but we'll remove them step by step over the next weeks.

New Android Enterprise registration mode

If you registered your organization with Android Enterprise before April 9, 2024, you had to choose between the Managed Google Play Account and the Managed Google Domain registration mode. If you register after that date, there’s only a single registration mode, Better Together Enterprise.

Read more

Android Enterprise device policies

We removed the Enable USB storage restriction from Android Enterprise device policies. This restriction only applies to legacy devices that Sophos Mobile no longer supports.

iOS device policies

We removed the supervised label from the Allow use of camera restriction of iOS device policies. Supervised and non-supervised devices support this restriction.

iOS device policy

We added the Allow alternative app marketplace setting to the Restrictions configuration of iOS device policies. When you turn the setting off, users can't install alternative app marketplaces, and any alternative app marketplace already installed is disabled.

Apple Business Manager profiles

In an Apple Business Manager profile, you can now configure more pages to be skipped by the iOS or macOS setup assistant. These pages are as follows:

• Safety
• Accessibility
• Term of Address
• Software Update Complete
• Get Started
• Restore Completed
• App Store
• Lockdown Mode
• Wallpaper

Some settings only apply to either iOS or macOS. For details, see the help pages for iOS profiles and macOS profiles.

Compliance policies

We removed the Apps from unknown sources allowed compliance rule for Android devices. This rule only applies to devices with Android 7.1 or earlier, which aren't supported anymore.

Supported macOS versions

We added support for macOS 14 (Sonoma) and removed support for macOS 10.14 (Mojave).

Sophos container end of support

Support for the Sophos container, including the Sophos Secure Email and Sophos Secure Workspace container apps, has ended. We encourage you to transition to Android Enterprise work profile enrollment and Apple User Enrollment, which are the Android and iOS equivalents of the Sophos container.

macOS policy changes

We added the following settings to the Restrictions configuration of macOS device and user policies:

• Allow Time Machine configuration
• Allow Startup Disk configuration
• Allow Bluetooth Sharing configuration
• Allow iCloud for Freeform
• Allow fingerprint configuration
• Allow File Sharing configuration
• Allow Internet Sharing configuration
• Allow Printer Sharing configuration
• Allow Remote Application Scripting configuration
• Allow Remote Management configuration
• Allow adding users

For details, see the help.

Reports

We added a Security Patch Level column to the Device inventory report. For Android devices, the column shows the version of the installed security update.

TLS version for device connections

Devices must use TLS 1.2 when connecting to Sophos Mobile. TLS 1.1 connections are rejected. This change only affects legacy device operating systems we don't support anymore.

iOS policy changes

• Added the Connect on demand automatically setting to the Per app VPN configuration of iOS device and user policies.
  When turned on, the device automatically starts the VPN when apps assigned to the VPN connect to the network. When turned off, the user must start the VPN.
• Added the Force local translation setting to the Restrictions configuration of iOS device and user policies.
  When turned on, the device doesn’t connect to Siri servers for translations.
• Added the following settings to the Restrictions configuration of iOS device policies:
  • Allow changing cellular plan settings: Users can change settings related to their cellular plan.
  • Allow Personal Hotspot: Users can modify Personal Hotspot settings.
  • Allow iCloud Private Relay: Users can use iCloud Private Relay.

  These three settings only apply to supervised devices.

Certificates in policies

You can now add two or more certificates with the same Common Name (CN) to a policy. Previously, Sophos Mobile rejected the second certificate as a duplicate. The changed behavior applies to root and client certificates.

For example, when you renew a certificate, you can add both the old and the renewed certificate to your policy.

iOS device policies

Added a new Allow iPhone widgets on Mac setting to the Restrictions configuration of iOS device policies. When you turn this setting off, users can’t use widgets from their iPhone apps on their Mac.

Windows kiosk mode

Added a note to the Kiosk mode configuration of Windows policies explaining that the kiosk app must be a Universal Windows Platform (UWP) app, not a Win32 app installed from an .msi file.

Dashboard widgets

Improved some widget titles on the Sophos Mobile dashboard to fit on a single line.

Android Wi-Fi configuration

We added the following settings to the Wi-Fi configuration of Android policies:

• Domain suffix match
• Subject alternative name match

On Android 11 and later with security updates released after April 2023, these settings are required for Wi-Fi connections that use the Extensible Authentication Protocol (EAP).

For details on using these settings, see Wi-Fi configuration (Android Enterprise device policy) and Wi-Fi configuration (Android Enterprise work profile policy).

ChromeOS synchronization interval

We removed the setting to configure the synchronization interval of the Sophos Chrome Security extension on ChromeOS devices.

ChromeOS devices use a fixed synchronization interval of 24 hours. For details, see Device synchronization.

User search in assistants

When you search for a user in the Add device, Assign user to device, or Invite users to VPP assistant, the user is automatically selected when there's only one match.

New menu look

We aligned the look of the Sophos Mobile menu with the new Sophos Central experience.

iOS 17 support

We added support for iOS 17 and iPadOS 17.

Improved user experience

We aligned the look of widgets on the Mobile dashboard with the main Sophos Central dashboard.

Mobile Threat Defense devices

We removed the Serial number property from the device details page of devices enrolled in Mobile Threat Defense management mode. For this management mode, devices don’t report their serial number to Sophos Mobile. The number shown was generated by Sophos Mobile for internal purposes.

Demo apps for trial licenses

We stopped adding the Sophos Secure Workspace and Sophos Secure Email apps to the demo data we create for trial licenses. As already announced, we’ll remove these apps from the app stores in December 2023 and won’t support them after this date.

Managed Google Play apps

We reduced the time it takes to send an installation task for a Managed Google Play app to Google. Note that after sending the task to Google, we can’t control when installation starts on the device.

User-less Android devices

The QR code and Zero-touch enrollment methods for Android Enterprise devices now support user-less devices such as kiosk devices.

User-less devices are Android Enterprise fully managed devices that you don’t connect with an email account during enrollment. Sophos Mobile doesn’t assign a user to the device.

Reset ActiveSync ID

We enhanced the Reset ActiveSync ID device action to allow resetting the ActiveSync ID Outlook device property. Previously, you could only reset the ActiveSync ID property.

ActiveSync ID is the ActiveSync ID sent by the native mail apps, Gmail on Android and Mail on iOS. ActiveSync ID Outlook is the ActiveSync ID sent by Microsoft Outlook.

Compliance rules

We removed the Google SafetyNet compatibility required compliance rule for Android devices. Google will discontinue the SafetyNet API soon.

Instead, Sophos Mobile apps use the Google Play Integrity API for checking device integrity. This feature is always active.

Windows Mobile

When we ended support for the Windows Mobile operating system in 2020, it was still available as a device platform in Sophos Mobile. Now, we’ve removed Windows Mobile from dashboard widgets and device filters.

Note that because Windows Mobile is not supported, managing Windows Mobile devices from Sophos Mobile might stop working without further notice. We recommend you delete any Windows Mobile devices still enrolled with Sophos Mobile.

Audit Log

We improved device deletion entries in the Sophos Central Audit Log to include the name of the account that did the deletion.

Compliance policies

We renamed the Maximum interval between synchronizations compliance rules for the different device platforms to include the type of synchronization the rule refers to.

For example, the Chromebook rule Maximum interval between synchronizations is now Maximum interval between Sophos Chrome Security synchronizations.

Web Filtering

The Web Filtering configuration page for iOS now has a note stating that web traffic from apps is also filtered and that you must not block domains any app depends on.

Supported software

We removed support for the following devices and mail servers:

• Android 7.0 and 7.1.
• Version 2004 (May 2020 Update) and earlier of Windows 10 Enterprise, Windows 10 Education, Windows 10 Pro, and Windows 10 Home.
• Exchange Server 2010 and 2013.

Policies

On the Email account pages of Android Enterprise policies, added a note that modern authentication with Gmail requires Google Chrome.

Web Filtering events

We reduced the volume of Web Filtering events for Intercept X for Mobile on iPhones and iPads by ignoring OS-level connections from iOS to Apple servers.

Device action: Set to “Not managed”

We removed the device action Set to “Not managed”. It was very rarely required and often used incorrectly. To remove a device when it loses its connection to Sophos Mobile, use the Delete action instead.

iOS apps

When you change the identifier of an iOS app after you added the app to Sophos Mobile, a new confirmation dialog will ask you to confirm the identifier.

Note that you can’t install the app if the identifier you enter in Sophos Mobile doesn’t match the value shown in iOS.

Apple Business Manager

In the Apple Business Manager profile settings for iOS, we renamed the options of the Assign user to device setting to make it more obvious which option to use.

• Yes - Basic authentication is now Yes - LDAPS authentication.
• Yes - Modern authentication is now Yes - Self Service Portal authentication.

You can hover over the options in Sophos Mobile for additional information.

Managed configuration for iOS and iPadOS apps

When you enter managed configuration settings for iOS or iPadOS apps, we automatically remove leading and trailing spaces and other whitespace characters. Apps might fail to read managed configuration if there’s extra whitespace. (SMCSRV-13729)

Access Point Name configuration

The Access Point Name (APN) configuration of iOS device policies doesn’t support iOS 16.0, iPadOS 16.1, or later. Use the Cellular configuration instead. The APN configuration hasn’t been recommended by Apple for some time and has now stopped working for the versions mentioned. (SMCSRV-13734)

Tasks

• We improved the layout of the Task details page. There's a new Task progress section showing the task's processing details. (SMCSRV-13694)
• To facilitate troubleshooting, failed tasks on the Tasks and Task archive pages now include a link to their Task details page. (SMCSRV-13696)

Log files

The confirmation dialog of the Get log files device action now shows the email address that receives the log files. (SMCSRV-13679)

Apple Business Manager

• The list of devices on the Apple DEP page now shows the profile status more prominently and highlights devices without an Apple Business Manager profile. (SMCSRV-13389)
• Sophos Mobile now uses your first Apple Business Manager profile as the default profile. Remember that you can change the default profile on the Apple DEP profiles tab of the Apple setup page. (SMCSRV-13390)

Extended device filter

You can now use the extended device filter to filter by external device ID. (SMCSRV-13650)

APNs certificate

When you renew an Apple Push Notification service (APNs) certificate, you can edit the email address field to reflect account changes you made in the Apple portal. (SMCSRV-13630)

iOS device policies

• You can now use the Web content filter configuration to filter the network traffic of individual apps on non-supervised iPhones and iPads. This requires iOS 16, iPadOS 16.1, or later. (SMCSRV-13486)
• The Restrictions configuration now contains a setting to turn off Mail Privacy Protection. This requires iOS 15.2, iPadOS 15.2, or later. (SMCSRV-13636)
• The Restrictions configuration now contains settings to configure and enforce Rapid Security Response updates. This requires iOS 16, iPadOS 16.1, or later. (SMCSRV-13635)