Test the endpoint health decision and the remediation path.
A practical Sophos integration pilot should show why a device is allowed or restricted and how it regains access after the required security condition is restored.
The published EasyNAC guide lists Sophos Central Cloud and Sophos Enterprise Console on-premises. This page focuses on planning a current Sophos Central deployment; review any legacy-console environment separately.
Connect the supported endpoint-security integration and AD where your access design requires it. Default Auto Trust includes AD-joined and XDR-managed checks. Confirm the current management recognition, then validate any supported health requirements separately.
Connect the integration.
- Deploy the EasyNAC appliance or VM, configure its IP and review discovered devices.
- For Sophos Central API Credentials Management, prepare the client ID and client secret. Enterprise Console uses the SQL host, port, database and authorized database credentials. Choose the connection method appropriate to your deployment.
- Confirm the managed-device recognition used by default Auto Trust, then select any additional documented health conditions required by your access policy.
- Use a managed test endpoint and an unapproved test device to verify access, restrictions and recovery.
Choose the Sophos connection method.
EasyNAC supports Sophos Central and Sophos Enterprise Console. The connection method determines the available checks. Sophos Central can use API Token Management or API Credentials Management; Enterprise Console queries its SQL Server database.
- Sophos Central with API Credentials Management: recognize devices running SAV, and tag malware infection, disabled tamper protection or devices that have not connected within a configured number of days.
- Sophos Central with API Token Management: recognize devices running SAV, and tag inactive on-access scanning, inactive device control or stale connections.
- Enterprise Console: recognize devices running SAV, and tag malware infection, inactive on-access scanning, application control or device control, old AV signatures and stale connections.
Turn Sophos status into an access decision.
The connector applies tags when enabled conditions match the information reported by the source. EasyNAC uses those tags in Auto Trust and role-based access decisions. Managed-device recognition and additional health requirements serve different purposes: the resulting access follows the policy in use.
For example, a Sophos Central API Credentials deployment can use the documented disabled-tamper-protection or malware condition as an input to a restricted-access rule. Preserve the services needed for management and remediation in that rule.
Checks refresh on the configured query interval; they are not an instantaneous live assessment of every endpoint. After correcting a condition, confirm the source has reported the change and EasyNAC has refreshed its information before checking restored access.
Prove the access outcome.
| Pilot case | What to demonstrate |
|---|---|
| Managed endpoint | Confirm a Sophos-managed endpoint receives its intended managed-device tag and access. |
| Protection condition | In a Central API Credentials pilot, verify the documented tamper-protection or malware condition against the intended policy outcome. |
| Reporting freshness | Check the configured stale-connection threshold and the tag it applies. |
| Recovery | Restore the condition, refresh the reported information and verify access and remediation connectivity. |
Record the source condition, EasyNAC tag, policy reason and access result in the Evaluation Kit scorecard. Agree the test and recovery procedure with your security team before changing endpoint conditions.
Keep the integration useful after deployment.
Maintain tenant and credential configuration, source-data freshness and the rules for missing data. Treat any Enterprise Console environment as a separate compatibility review rather than copying a Sophos Central configuration.
Expand only after the first network’s device matching, access and recovery behavior is understood. Review EasyNAC appliances, remote Enforcer Sensors and optional CVM when planning branches or regions.
Common questions.
Which Sophos checks are available?
The checks depend on the connection method. Central API Credentials Management includes managed-device recognition, malware, tamper protection and stale connections. Central API Token Management and Enterprise Console expose different checks, listed above.
Does a Sophos status tag itself block a device?
The tag records the matching condition. EasyNAC access follows the Auto Trust, role and access rules in use, including the management or remediation access your policy retains.
Sources and deployment scope.
Prepared by InfoExpress, Inc., the company behind EasyNAC. The connector checks described here were verified against the EasyNAC appliance help on 14 October 2026. Product API references provide source-platform background. Confirm availability for your connector version and source-product configuration.
Test it on your network.
Agree the requirements, connect a representative endpoint and record the actual result.