Deploy Sophos Endpoint as a Custom App

By Emalee Firestein

Learn how to deploy Sophos Central to your macOS devices as a custom app

Depending on the App product and version installed, the app path, privacy access, and kernel or system extension requirements may change. As with all Custom Apps, we urge you to test this thoroughly before deploying it to a Mac in production.

Prerequisites

Download the Sophos installer file from your Sophos admin portal.
Copy the sophos_ae_script.zsh script from the Kandji support GitHub repository (GitHub Link).
Download the sophos_central_settings.mobileconfig file from the Kandji support GitHub repository (GitHub Link). You can right-click the link and select Save link as… to download the mobileconfig file directly.
- This configuration profile enables Notifications, System Extensions, Privacy Preferences (PPPC) to have Full Disk Access, and a Network content filter. More information about Sophos's required System Extensions is available here.
- A Legacy System Extension (KEXT) version of the profile for macOS Catalina and below can be downloaded here.
Download the sophos_management.mobileconfig file from the Kandji support GitHub repository (GitHub Link). You can right-click the link and select Save link as… to download the mobileconfig file directly.
- This configuration profile allows managed background items for Sophos Central.
Copy the Sophos postinstall script from the Kandji support GitHub repository (GitHub Link).

Add a Custom Settings Profile

In the left-hand menu, click on Library.
Near the top-right, click Add New.
Select Custom Profile.
Click Add & Configure.

Configure the Custom Settings Profile

Give the profile a name.
Assign the custom profile to a test Blueprint.
For Install on, select Mac.
If deploying the KEXT version of the configuration profile, configure an Assignment rule that will deploy the file to macOS Catalina and below.
Upload either the sophos_central_settings.mobileconfig (or KEXT version) file you downloaded previously.
Click Save.

Configure the Service Management Profile

Create a Custom Configuration Profile in Kandji by selecting Library > Add New > Custom Profile > Add & Configure.
Give the profile a name.
Assign your custom profile to the same test Blueprint as above.
For Install on, select Mac.
When adding this profile, add an Assignment Rule to only apply the profile to computers where the macOS Version is greater than or equal to 13.0, as shown below.
Upload the profile that you downloaded previously from GitHub.

Click Save.

Using an Assignment Rule for the service management payload ensures this payload is only deployed to Mac computers running macOS Ventura or later. The audit and enforcement script provided by Kandji only checks for the presence of the service management payload on macOS Ventura or later.

Add a Custom App

In the left-hand menu, click on Library
Near the top-right, click Add New
Select Custom app
Click Add & Configure

Custom App

Give the Custom App a name. (Example: Sophos Central.) Optionally, add a custom icon.
Assign to a test blueprint.
(optional) Configure Assignment Rules if you would like to limit the devices that received the custom app.
Change the installation type to Audit and Enforce.
Copy and paste the sophos_central_ae_script.zsh script from earlier into the Audit & Enforce text box. No modification needed.
- The script looks for two profile identifiers and the name of the installed Sophos app before attempting to install the app. If you would like to use this script with another profile, update the profile identifier prefix information to match what is in your profile.
```
Settings Profile prefix: io.kandji.sophos.EA69037E
Background Service Management Profile prefix: io.kandji.sophos.service-management
App name: "Sophos Endpoint.app"
```
Select ZIP File (unzip contents into specified directory) as the deployment type.
Set the Unzip Location to: /var/tmp
Upload the installer zip file downloaded earlier.
Click Add Postinstall Script.
Paste the Post-Install Script from the Kandji support GitHub into the post-installer text field. Be sure to copy all text, including the #!/bin/sh (shebang) line at the top.
Click Save.