Sophos Mobile

New iOS restrictions

We added the following restrictions to iOS device policies:

• Allow changing the default calling app: If you turn this setting off, users can't change the default calling app.
• Allow changing the default messaging app: If you turn this setting off, users can't change the default messaging app.
• Allow Smart Reply in Mail: Users can use the AI-powered Smart Reply feature in the Mail app to reply to an email.
• Allow Notes transcription: Users can use Apple Intelligence to transcribe audio recordings in the Notes app.
• Allow Notes transcription summary: Users can use Apple Intelligence to summarize audio recordings in the Notes app.
• Allow Summarize in Safari: Users can use the AI-powered Summarize feature in Safari to summarize web pages. If you turn this setting off, users can still use Writing Tools to summarize text they select in Safari.
• Allow visual intelligence summaries: Users can use visual intelligence to summarize text they photographed with the device camera.
• Allow Apple Intelligence Report: If you turn this setting off, users can't generate the Apple Intelligence Report, which shows the requests the device has sent to Private Cloud Compute.

Android Factory Reset Protection

We improved the validation of Google+ IDs you enter on the Google setup page to configure the Android Factory Reset Protection feature. You can no longer accidentally enter an email address instead of an ID.

New iOS restrictions

We added the following restrictions to iOS device policies:

• Allow satellite connections: Users can connect to satellite services.
• Allow changing the default browser app: If you turn this setting off, users can't change the default browser app.
• Allow external Apple Intelligence integrations: Users can use third-party, cloud-based intelligence services with Siri.
• Allow signing in to external Apple Intelligence integrations: If you turn this setting off, users can only use third-party intelligence services with Siri in anonymous mode.

New "Software update" configuration for macOS

We added a Software update configuration to macOS device policies. This configuration lets you manage macOS system settings for software updates.

For details, see the help.

macOS app installation configuration

We removed the Require admin password setting from the App Store configuration of macOS user policies because Apple no longer recommends using it.

Instead, use the Require admin password for app installations setting in the new Software update configuration of macOS device policies.

iOS and macOS Wi-Fi configuration validations

We improved the validation of the TLS minimum version, TLS maximum version, and External identity fields in the Wi-Fi configurations of iOS and macOS device and user policies.

TeamViewer integration

We improved the TeamViewer setup page to better describe the actions admins can perform during a TeamViewer remote session.

Revoking Apple VPP registration

We added a warning to the dialog for revoking a user's VPP registration. The warning explains that if the user has enrolled an iPhone or iPad in Apple User Enrollment management mode, you can no longer install apps on that device via Sophos Mobile.

macOS configuration profiles in task bundles

You can now use the Assign imported policy task in macOS task bundles to assign Apple configuration profiles you imported to Sophos Mobile.

Kernel extension policy

We removed the Kernel extension policy configuration from macOS device policies. This configuration only applies to macOS 10.15 Catalina and earlier, which Sophos Mobile doesn't support.

Apple Business Manager profiles

We added settings to Apple Business Manager profiles that let you skip the correspondent page in the setup assistant.

This setting applies to iOS, iPadOS, and macOS:

• Apple Intelligence

These settings apply to iOS and iPadOS only:

• Lockdown Mode
• Web Content Filtering
• Camera Control

Android restriction

We improved the tooltip of the Allow app uninstall restriction to clarify that this setting also prevents administrators from uninstalling apps via Sophos Mobile.

Windows apps

We had to remove the Get data button from the Edit Windows app page because Microsoft removed the underlying API. We replaced this button with the Get Store ID button, which lets you fill in the Store ID automatically.

For information on how to get the app properties you previously could fill in with Get data, see Get Windows app properties.

Intercept X for Mobile enrollment configuration

We added a note to the Intercept X and Intune MTD tabs of the Sophos setup page explaining that you can only configure one of these tabs at a time.

macOS configuration profiles

You can now assign imported macOS configuration profiles using the Assign policy action on a Mac's Show device page.

New iOS restrictions

We added the following restrictions to iOS device policies:

• Allow call recordings: Users can record phone calls and view the transcript in the Notes app.
• Allow locking apps: When you turn this setting off, the following commands to lock an app aren't available in its quick actions menu:
  • Require Face ID
  • Require Touch ID
  • Require Passcode
• Allow hiding apps: When you turn this setting off, the following commands to hide an app aren't available in its quick actions menu:
  • Hide and Require Face ID
  • Hide and Require Touch ID
  • Hide and Require Passcode
  Hiding an app moves it to the Hidden folder in the App Library and requires Face ID, Touch ID, or the passcode to open it.
• Allow summarizing emails: When you turn this setting off, the Summarize command in Mail isn't available. This command uses Apple Intelligence to summarize an email message or thread.
• Allow RCS: Users can send messages via RCS (Rich Communication Services).

Read more

Intercept X for Mobile enrollment

You can enroll Intercept X for Mobile with Sophos Mobile using the same QR code for all your Android devices, iPhones, and iPads.

Because the QR code doesn't contain information about a Sophos Mobile user, devices enrolled with it don't have a user assigned. You can assign a user after enrollment.

See Enroll Intercept X for Mobile with a static QR code.

"Allow managing Google accounts" Android restriction

In Android Enterprise device policies, the Allow managing Google accounts restriction is only available when you turn on Allow managing accounts.

When Allow managing accounts is turned off, this also affects Google accounts.

CSV injection prevention

We enhanced the CSV export from Sophos Mobile to mitigate security risks when opening exported files in spreadsheet applications that support active content.

Input limitations

For performance reasons, the following input fields have a limit of 5,000 entries and 130,000 characters:

• The Allowed domains and Blocked domains fields in the Web Filtering configuration of Mobile Threat Defense policies for Android and iOS, and Chrome Security policies.
• The Allowed URLs and Blocked URLs fields in the Web content filter configuration of iOS device policies.
• The Email domains and Web domains fields in the Managed domains configuration of iOS device policies, macOS device policies, and macOS user policies.
• The Domains in Safari, Domains in Calendar, Domains in Contacts, and Domains in Mail fields in the Per app VPN configuration of iOS device policies and iOS user policies.

Apple User Enrollment with the "Add device" assistant

We adjusted the version information in the Add device assistant for profile-based Apple User Enrollment.

Profile-based Apple User Enrollment requires iOS 17, iPadOS 17, or earlier.

Windows MSI apps

We improved the validation of installation options you enter for Windows MSI links.

Windows Mobile support

Although Windows Mobile support ended on December 31, 2019, some features were still available to customers who enabled the Windows Mobile platform in Sophos Mobile before that date.

We'll soon remove the following features from Sophos Mobile:

• Add Windows Mobile devices, apps, and policies.
• Enroll Windows Mobile devices in Sophos Central Self Service Portal.

Apple Business Manager apps

We improved the automatic update of apps on Apple Business Manager iPhones and iPads. When you turn on Automatically update iOS VPP apps on the Apple VPP setup page, not only device-assigned apps on devices with Apple Device Enrollment management mode are automatically updated, but also user-assigned apps on devices with Apple User Enrollment management mode.

Sophos container feature removal

Following the Sophos container end of life in December 2023, we're now deleting all Sophos Secure Workspace work documents you uploaded to Sophos Mobile.

We removed the option to highlight compliance policies relevant to the Sophos container management mode from the Edit compliance policy page.

Importing macOS configuration profiles

You can now import Apple configuration profiles you created in Apple Configurator or got from other sources to install them on Macs.

Read more

Android kiosk mode settings

We added a tooltip to the Allow volume change setting of the Kiosk mode configuration of Android Enterprise device policies. The tooltip explains that the device is muted when the setting is turned off.

Sophos container feature removal

Following the Sophos container end of life in December 2023, we're now removing the following features from Sophos Mobile:

• Adding work documents
• Updating existing work documents
• Creating Android and iOS container policies

We'll be deleting existing work documents from all accounts soon.

Supported device platforms

• We added support for Android 15 and removed support for Android 8.
• We added support for iOS and iPadOS 18 and removed support for iOS and iPadOS 14.
• We added support for macOS 15 (Sequoia) and removed support for macOS 10.15 (Catalina).

Supported mail servers

We removed support for the Zimbra mail server.

New iOS restrictions

We added the following restrictions to iOS device policies:

• Allow app installation from a website: Users can install apps from a website.
• Allow iPhone mirroring on Macs: Users can use iPhone Mirroring on a Mac to control their device.
• Allow video conferencing remote control: In FaceTime calls, users can allow another user to control their device via SharePlay Remote Control.
• Allow Live Voicemail: If you clear the checkbox, Live Voicemail is unavailable.
• Preserve eSIM on erase: The eSIM is preserved when the device is erased with the Erase All Content and Settings action or when an incorrect password is entered too many times.
• Allow eSIM transfer to another device: Users can transfer their eSIM to another device.
• Allow automatic dimming: If you clear the checkbox, the automatic dimming of iPads with OLED displays is turned off.
• Allow Genmoji: Users can use the AI-powered Genmoji feature to create custom emojis by typing a description.
• Allow Image Wand: Users can use the AI-powered Image Wand feature to create images from sketches and text in their Notes app.
• Allow Image Playground: Users can use the AI-powered Image Playground feature to create images.
• Allow Writing Tools: Users can use the AI-powered Writing Tools feature to create, proofread, rewrite, or summarize text.
• Allow output in user’s handwriting: Users can use Apple Intelligence to create content in their own handwriting.

Read more

New Android restrictions

We added the following restriction to Android Enterprise device policies and work profile policies:

• Allow sharing of managed Wi-Fi connections: If the checkbox is cleared, users can’t share Wi-Fi connections configured by Sophos Mobile.

Read more

Account-driven Apple User Enrollment

You can now use account-driven Apple User Enrollment to enroll iPhones and iPads owned by your users. Account-driven Apple User Enrollment is more streamlined than the old profile-based Apple User Enrollment because the workflow is built into the device’s Settings app.

Account-driven Apple User Enrollment is available for iOS and iPadOS 15 and later. Profile-based Apple User Enrollment is available for iOS and iPadOS 17 and earlier.

Read more

Android 15

A known issue in preview versions of Android 15 prevents devices from being enrolled with Sophos Mobile or other Mobile Device Management (MDM) software. If this issue persists after the release of Android 15, enrollment tasks will fail with the following error: The enrollment type of the device doesn't support the selected action (error -115).

Sophos Chrome Security

We released a new version of Sophos Chrome Security, our Sophos Mobile client on Chromebooks. This version, 2.0.2218, requires ChromeOS 110 or later, which has been available since January 2023.

Windows Home support

Microsoft has removed Windows Home from its list of Windows editions that support device management through Mobile Device Management (MDM) solutions, such as Sophos Mobile. To manage a Windows computer with Sophos Mobile, Windows Enterprise, Education, or Pro must be installed. For details on supported versions, see the Requirements tab.

Chromebook Data Lake uploads

The Chromebook data we upload to the Sophos Data Lake now includes information about app installation sources. You can already access the new data through our XDR Query API. Over the next releases, we'll add queries in Live Discover that take advantage of the new data.

For information about the XDR Query API, see Getting Started with XDR Query and the Mobile schema documentation.

Android password restrictions

With Android 12, Google has simplified the configuration of password complexity requirements to unlock the display. The Password policies - Device configuration of Android Enterprise work profile policies now has a Minimum password complexity list that lets you choose from three levels, Low, Medium, and High, each with fixed complexity rules.

Read more

Find devices

When finding devices is disabled in the Sophos Mobile privacy settings, the Find device action is disabled instead of removed and shows a tooltip with information about how to enable it.

Improved user experience

The Install app button on the Installed apps tab of the Show device page is highlighted to improve its visibility.

EAS proxy

We removed the Restrict to Sophos Secure Email setting from the EAS proxy configuration.

Support for Sophos Secure Email ended in December 2023. Some features still work, but we'll remove them step by step over the next weeks.

Improved user experience

The following buttons are now highlighted to improve their visibility:

• The Install app button on the Installed apps tab of the Show device page for Android devices.
• The Download certificate signing request button on the CSR page of the APNs certificate wizard.

Work documents

The Sophos Secure Workspace apps for Android and iOS can no longer download work documents from Sophos Mobile.

Support for Sophos Secure Workspace ended in December 2023. Some features still work, but we'll remove them step by step over the next weeks.

New Android Enterprise registration mode

If you registered your organization with Android Enterprise before April 9, 2024, you had to choose between the Managed Google Play Account and the Managed Google Domain registration mode. If you register after that date, there’s only a single registration mode, Better Together Enterprise.

Read more

Android Enterprise device policies

We removed the Enable USB storage restriction from Android Enterprise device policies. This restriction only applies to legacy devices that Sophos Mobile no longer supports.

iOS device policies

We removed the supervised label from the Allow use of camera restriction of iOS device policies. Supervised and non-supervised devices support this restriction.

iOS device policy

We added the Allow alternative app marketplace setting to the Restrictions configuration of iOS device policies. When you turn the setting off, users can't install alternative app marketplaces, and any alternative app marketplace already installed is disabled.

Apple Business Manager profiles

In an Apple Business Manager profile, you can now configure more pages to be skipped by the iOS or macOS setup assistant. These pages are as follows:

• Safety
• Accessibility
• Term of Address
• Software Update Complete
• Get Started
• Restore Completed
• App Store
• Lockdown Mode
• Wallpaper

Some settings only apply to either iOS or macOS. For details, see the help pages for iOS profiles and macOS profiles.

Compliance policies

We removed the Apps from unknown sources allowed compliance rule for Android devices. This rule only applies to devices with Android 7.1 or earlier, which aren't supported anymore.

Supported macOS versions

We added support for macOS 14 (Sonoma) and removed support for macOS 10.14 (Mojave).

Sophos container end of support

Support for the Sophos container, including the Sophos Secure Email and Sophos Secure Workspace container apps, has ended. We encourage you to transition to Android Enterprise work profile enrollment and Apple User Enrollment, which are the Android and iOS equivalents of the Sophos container.

macOS policy changes

We added the following settings to the Restrictions configuration of macOS device and user policies:

• Allow Time Machine configuration
• Allow Startup Disk configuration
• Allow Bluetooth Sharing configuration
• Allow iCloud for Freeform
• Allow fingerprint configuration
• Allow File Sharing configuration
• Allow Internet Sharing configuration
• Allow Printer Sharing configuration
• Allow Remote Application Scripting configuration
• Allow Remote Management configuration
• Allow adding users

For details, see the help.

Reports

We added a Security Patch Level column to the Device inventory report. For Android devices, the column shows the version of the installed security update.

TLS version for device connections

Devices must use TLS 1.2 when connecting to Sophos Mobile. TLS 1.1 connections are rejected. This change only affects legacy device operating systems we don't support anymore.

iOS policy changes

• Added the Connect on demand automatically setting to the Per app VPN configuration of iOS device and user policies.
  When turned on, the device automatically starts the VPN when apps assigned to the VPN connect to the network. When turned off, the user must start the VPN.
• Added the Force local translation setting to the Restrictions configuration of iOS device and user policies.
  When turned on, the device doesn’t connect to Siri servers for translations.
• Added the following settings to the Restrictions configuration of iOS device policies:
  • Allow changing cellular plan settings: Users can change settings related to their cellular plan.
  • Allow Personal Hotspot: Users can modify Personal Hotspot settings.
  • Allow iCloud Private Relay: Users can use iCloud Private Relay.

  These three settings only apply to supervised devices.

Certificates in policies

You can now add two or more certificates with the same Common Name (CN) to a policy. Previously, Sophos Mobile rejected the second certificate as a duplicate. The changed behavior applies to root and client certificates.

For example, when you renew a certificate, you can add both the old and the renewed certificate to your policy.

iOS device policies

Added a new Allow iPhone widgets on Mac setting to the Restrictions configuration of iOS device policies. When you turn this setting off, users can’t use widgets from their iPhone apps on their Mac.

Windows kiosk mode

Added a note to the Kiosk mode configuration of Windows policies explaining that the kiosk app must be a Universal Windows Platform (UWP) app, not a Win32 app installed from an .msi file.

Dashboard widgets

Improved some widget titles on the Sophos Mobile dashboard to fit on a single line.

Android Wi-Fi configuration

We added the following settings to the Wi-Fi configuration of Android policies:

• Domain suffix match
• Subject alternative name match

On Android 11 and later with security updates released after April 2023, these settings are required for Wi-Fi connections that use the Extensible Authentication Protocol (EAP).

For details on using these settings, see Wi-Fi configuration (Android Enterprise device policy) and Wi-Fi configuration (Android Enterprise work profile policy).

ChromeOS synchronization interval

We removed the setting to configure the synchronization interval of the Sophos Chrome Security extension on ChromeOS devices.

ChromeOS devices use a fixed synchronization interval of 24 hours. For details, see Device synchronization.

User search in assistants

When you search for a user in the Add device, Assign user to device, or Invite users to VPP assistant, the user is automatically selected when there's only one match.

New menu look

We aligned the look of the Sophos Mobile menu with the new Sophos Central experience.

iOS 17 support

We added support for iOS 17 and iPadOS 17.

Improved user experience

We aligned the look of widgets on the Mobile dashboard with the main Sophos Central dashboard.

Mobile Threat Defense devices

We removed the Serial number property from the device details page of devices enrolled in Mobile Threat Defense management mode. For this management mode, devices don’t report their serial number to Sophos Mobile. The number shown was generated by Sophos Mobile for internal purposes.

Demo apps for trial licenses

We stopped adding the Sophos Secure Workspace and Sophos Secure Email apps to the demo data we create for trial licenses. As already announced, we’ll remove these apps from the app stores in December 2023 and won’t support them after this date.

Managed Google Play apps

We reduced the time it takes to send an installation task for a Managed Google Play app to Google. Note that after sending the task to Google, we can’t control when installation starts on the device.

User-less Android devices

The QR code and Zero-touch enrollment methods for Android Enterprise devices now support user-less devices such as kiosk devices.

User-less devices are Android Enterprise fully managed devices that you don’t connect with an email account during enrollment. Sophos Mobile doesn’t assign a user to the device.

Reset ActiveSync ID

We enhanced the Reset ActiveSync ID device action to allow resetting the ActiveSync ID Outlook device property. Previously, you could only reset the ActiveSync ID property.

ActiveSync ID is the ActiveSync ID sent by the native mail apps, Gmail on Android and Mail on iOS. ActiveSync ID Outlook is the ActiveSync ID sent by Microsoft Outlook.

Compliance rules

We removed the Google SafetyNet compatibility required compliance rule for Android devices. Google will discontinue the SafetyNet API soon.

Instead, Sophos Mobile apps use the Google Play Integrity API for checking device integrity. This feature is always active.

Windows Mobile

When we ended support for the Windows Mobile operating system in 2020, it was still available as a device platform in Sophos Mobile. Now, we’ve removed Windows Mobile from dashboard widgets and device filters.

Note that because Windows Mobile is not supported, managing Windows Mobile devices from Sophos Mobile might stop working without further notice. We recommend you delete any Windows Mobile devices still enrolled with Sophos Mobile.

Audit Log

We improved device deletion entries in the Sophos Central Audit Log to include the name of the account that did the deletion.

Compliance policies

We renamed the Maximum interval between synchronizations compliance rules for the different device platforms to include the type of synchronization the rule refers to.

For example, the Chromebook rule Maximum interval between synchronizations is now Maximum interval between Sophos Chrome Security synchronizations.

Web Filtering

The Web Filtering configuration page for iOS now has a note stating that web traffic from apps is also filtered and that you must not block domains any app depends on.

Supported software

We removed support for the following devices and mail servers:

• Android 7.0 and 7.1.
• Version 2004 (May 2020 Update) and earlier of Windows 10 Enterprise, Windows 10 Education, Windows 10 Pro, and Windows 10 Home.
• Exchange Server 2010 and 2013.

Policies

On the Email account pages of Android Enterprise policies, added a note that modern authentication with Gmail requires Google Chrome.

Web Filtering events

We reduced the volume of Web Filtering events for Intercept X for Mobile on iPhones and iPads by ignoring OS-level connections from iOS to Apple servers.

Device action: Set to “Not managed”

We removed the device action Set to “Not managed”. It was very rarely required and often used incorrectly. To remove a device when it loses its connection to Sophos Mobile, use the Delete action instead.

iOS apps

When you change the identifier of an iOS app after you added the app to Sophos Mobile, a new confirmation dialog will ask you to confirm the identifier.

Note that you can’t install the app if the identifier you enter in Sophos Mobile doesn’t match the value shown in iOS.

Apple Business Manager

In the Apple Business Manager profile settings for iOS, we renamed the options of the Assign user to device setting to make it more obvious which option to use.

• Yes - Basic authentication is now Yes - LDAPS authentication.
• Yes - Modern authentication is now Yes - Self Service Portal authentication.

You can hover over the options in Sophos Mobile for additional information.

Managed configuration for iOS and iPadOS apps

When you enter managed configuration settings for iOS or iPadOS apps, we automatically remove leading and trailing spaces and other whitespace characters. Apps might fail to read managed configuration if there’s extra whitespace. (SMCSRV-13729)

Access Point Name configuration

The Access Point Name (APN) configuration of iOS device policies doesn’t support iOS 16.0, iPadOS 16.1, or later. Use the Cellular configuration instead. The APN configuration hasn’t been recommended by Apple for some time and has now stopped working for the versions mentioned. (SMCSRV-13734)

Tasks

• We improved the layout of the Task details page. There's a new Task progress section showing the task's processing details. (SMCSRV-13694)
• To facilitate troubleshooting, failed tasks on the Tasks and Task archive pages now include a link to their Task details page. (SMCSRV-13696)

Log files

The confirmation dialog of the Get log files device action now shows the email address that receives the log files. (SMCSRV-13679)

Apple Business Manager

• The list of devices on the Apple DEP page now shows the profile status more prominently and highlights devices without an Apple Business Manager profile. (SMCSRV-13389)
• Sophos Mobile now uses your first Apple Business Manager profile as the default profile. Remember that you can change the default profile on the Apple DEP profiles tab of the Apple setup page. (SMCSRV-13390)

Extended device filter

You can now use the extended device filter to filter by external device ID. (SMCSRV-13650)

APNs certificate

When you renew an Apple Push Notification service (APNs) certificate, you can edit the email address field to reflect account changes you made in the Apple portal. (SMCSRV-13630)

iOS device policies

• You can now use the Web content filter configuration to filter the network traffic of individual apps on non-supervised iPhones and iPads. This requires iOS 16, iPadOS 16.1, or later. (SMCSRV-13486)
• The Restrictions configuration now contains a setting to turn off Mail Privacy Protection. This requires iOS 15.2, iPadOS 15.2, or later. (SMCSRV-13636)
• The Restrictions configuration now contains settings to configure and enforce Rapid Security Response updates. This requires iOS 16, iPadOS 16.1, or later. (SMCSRV-13635)