Sophos Mobile

iOS device policies

Added a new Allow iPhone widgets on Mac setting to the Restrictions configuration of iOS device policies. When you turn this setting off, users can’t use widgets from their iPhone apps on their Mac.

Windows kiosk mode

Added a note to the Kiosk mode configuration of Windows policies explaining that the kiosk app must be a Universal Windows Platform (UWP) app, not a Win32 app installed from an .msi file.

Dashboard widgets

Improved some widget titles on the Sophos Mobile dashboard to fit on a single line.

Android Wi-Fi configuration

We added the following settings to the Wi-Fi configuration of Android policies:

• Domain suffix match
• Subject alternative name match

On Android 11 and later with security updates released after April 2023, these settings are required for Wi-Fi connections that use the Extensible Authentication Protocol (EAP).

For details on using these settings, see Wi-Fi configuration (Android Enterprise device policy) and Wi-Fi configuration (Android Enterprise work profile policy).

ChromeOS synchronization interval

We removed the setting to configure the synchronization interval of the Sophos Chrome Security extension on ChromeOS devices.

ChromeOS devices use a fixed synchronization interval of 24 hours. For details, see Device synchronization.

User search in assistants

When you search for a user in the Add device, Assign user to device, or Invite users to VPP assistant, the user is automatically selected when there's only one match.

New menu look

We aligned the look of the Sophos Mobile menu with the new Sophos Central experience.

iOS 17 support

We added support for iOS 17 and iPadOS 17.

Improved user experience

We aligned the look of widgets on the Mobile dashboard with the main Sophos Central dashboard.

Mobile Threat Defense devices

We removed the Serial number property from the device details page of devices enrolled in Mobile Threat Defense management mode. For this management mode, devices don’t report their serial number to Sophos Mobile. The number shown was generated by Sophos Mobile for internal purposes.

Demo apps for trial licenses

We stopped adding the Sophos Secure Workspace and Sophos Secure Email apps to the demo data we create for trial licenses. As already announced, we’ll remove these apps from the app stores in December 2023 and won’t support them after this date.

Managed Google Play apps

We reduced the time it takes to send an installation task for a Managed Google Play app to Google. Note that after sending the task to Google, we can’t control when installation starts on the device.

User-less Android devices

The QR code and Zero-touch enrollment methods for Android Enterprise devices now support user-less devices such as kiosk devices.

User-less devices are Android Enterprise fully managed devices that you don’t connect with an email account during enrollment. Sophos Mobile doesn’t assign a user to the device.

Reset ActiveSync ID

We enhanced the Reset ActiveSync ID device action to allow resetting the ActiveSync ID Outlook device property. Previously, you could only reset the ActiveSync ID property.

ActiveSync ID is the ActiveSync ID sent by the native mail apps, Gmail on Android and Mail on iOS. ActiveSync ID Outlook is the ActiveSync ID sent by Microsoft Outlook.

Compliance rules

We removed the Google SafetyNet compatibility required compliance rule for Android devices. Google will discontinue the SafetyNet API soon.

Instead, Sophos Mobile apps use the Google Play Integrity API for checking device integrity. This feature is always active.

Windows Mobile

When we ended support for the Windows Mobile operating system in 2020, it was still available as a device platform in Sophos Mobile. Now, we’ve removed Windows Mobile from dashboard widgets and device filters.

Note that because Windows Mobile is not supported, managing Windows Mobile devices from Sophos Mobile might stop working without further notice. We recommend you delete any Windows Mobile devices still enrolled with Sophos Mobile.

Audit Log

We improved device deletion entries in the Sophos Central Audit Log to include the name of the account that did the deletion.

Compliance policies

We renamed the Maximum interval between synchronizations compliance rules for the different device platforms to include the type of synchronization the rule refers to.

For example, the Chromebook rule Maximum interval between synchronizations is now Maximum interval between Sophos Chrome Security synchronizations.

Web Filtering

The Web Filtering configuration page for iOS now has a note stating that web traffic from apps is also filtered and that you must not block domains any app depends on.

Supported software

We removed support for the following devices and mail servers:

• Android 7.0 and 7.1.
• Version 2004 (May 2020 Update) and earlier of Windows 10 Enterprise, Windows 10 Education, Windows 10 Pro, and Windows 10 Home.
• Exchange Server 2010 and 2013.

Policies

On the Email account pages of Android Enterprise policies, added a note that modern authentication with Gmail requires Google Chrome.

Web Filtering events

We reduced the volume of Web Filtering events for Intercept X for Mobile on iPhones and iPads by ignoring OS-level connections from iOS to Apple servers.

Device action: Set to “Not managed”

We removed the device action Set to “Not managed”. It was very rarely required and often used incorrectly. To remove a device when it loses its connection to Sophos Mobile, use the Delete action instead.

iOS apps

When you change the identifier of an iOS app after you added the app to Sophos Mobile, a new confirmation dialog will ask you to confirm the identifier.

Note that you can’t install the app if the identifier you enter in Sophos Mobile doesn’t match the value shown in iOS.

Apple Business Manager

In the Apple Business Manager profile settings for iOS, we renamed the options of the Assign user to device setting to make it more obvious which option to use.

• Yes - Basic authentication is now Yes - LDAPS authentication.
• Yes - Modern authentication is now Yes - Self Service Portal authentication.

You can hover over the options in Sophos Mobile for additional information.

Managed configuration for iOS and iPadOS apps

When you enter managed configuration settings for iOS or iPadOS apps, we automatically remove leading and trailing spaces and other whitespace characters. Apps might fail to read managed configuration if there’s extra whitespace. (SMCSRV-13729)

Access Point Name configuration

The Access Point Name (APN) configuration of iOS device policies doesn’t support iOS 16.0, iPadOS 16.1, or later. Use the Cellular configuration instead. The APN configuration hasn’t been recommended by Apple for some time and has now stopped working for the versions mentioned. (SMCSRV-13734)

Tasks

• We improved the layout of the Task details page. There's a new Task progress section showing the task's processing details. (SMCSRV-13694)
• To facilitate troubleshooting, failed tasks on the Tasks and Task archive pages now include a link to their Task details page. (SMCSRV-13696)

Log files

The confirmation dialog of the Get log files device action now shows the email address that receives the log files. (SMCSRC-13679)

Apple Business Manager

• The list of devices on the Apple DEP page now shows the profile status more prominently and highlights devices without an Apple Business Manager profile. (SMCSRV-13389)
• Sophos Mobile now uses your first Apple Business Manager profile as the default profile. Remember that you can change the default profile on the Apple DEP profiles tab of the Apple setup page. (SMCSRV-13390)

Extended device filter

You can now use the extended device filter to filter by external device ID. (SMCSRV-13650)

APNs certificate

When you renew an Apple Push Notification service (APNs) certificate, you can edit the email address field to reflect account changes you made in the Apple portal. (SMCSRV-13630)

iOS device policies

• You can now use the Web content filter configuration to filter the network traffic of individual apps on non-supervised iPhones and iPads. This requires iOS 16, iPadOS 16.1, or later. (SMCSRV-13486)
• The Restrictions configuration now contains a setting to turn off Mail Privacy Protection. This requires iOS 15.2, iPadOS 15.2, or later. (SMCSRV-13636)
• The Restrictions configuration now contains settings to configure and enforce Rapid Security Response updates. This requires iOS 16, iPadOS 16.1, or later. (SMCSRV-13635)