Sophos endpoint, XDR and email licensing covers the products Sophos sells as subscriptions and manages from Sophos Fusion: Sophos Endpoint, Sophos EDR, Sophos XDR, Next-Gen SIEM, Identity Threat Detection and Response, Workspace Protection, Sophos Email and related add-ons. The Licensing Guidelines list each of them with its licensing model (subscription) and applicable unit (per User, per Server, or both).[1] The customer’s Schedule states how many units it bought, and the End User Terms of Use turn that number into the customer’s Use Level.[9] This article covers the product rules, how Sophos Fusion reports usage, and where the console count and the contract can differ. The general model is described in named user licensing.
Editions
Endpoint tiers. Sophos removed “Intercept X” from its endpoint product names in October 2025. The price list now shows “Central Intercept X Advanced” as “Sophos Endpoint – User” and “Central Intercept X Advanced for Server” as “Sophos Endpoint – Server”.[7] The same announcement added a Sophos EDR licence tier between Sophos Endpoint and Sophos XDR. It went on sale for term licences on 2025-11-01 and for MSP Flex in late January 2026.[7] Sophos also announced Sophos Endpoint 100, a fixed-price subscription only for organizations with up to 100 employees, and an add-on for legacy operating systems.[7]
Intercept X Essentials end of sale. The last order date for new Intercept X Essentials licences (CIXE and SVRCIXE) was 2025-11-01, and the last renewal date was 2026-01-07. After that, customers had to upgrade to Sophos Endpoint (CIXA and SVRCIXA) at renewal. MSP Flex Essentials subscriptions were upgraded automatically, and monthly bills reflected the new subscriptions from February 2026.[7] Catalog: Intercept X Essentials end of sale; renew onto Sophos Endpoint; SKUs CIXE and SVRCIXE.
| Product (Licensing Guidelines name) | Unit | Limits and notes |
|---|---|---|
| Sophos Endpoint | per User[1] | None stated |
| Sophos Endpoint for Server | per Server[1] | None stated |
| Sophos EDR | per User; per Server[1] | Data Lake 20MB/day (User) or 40MB/day (Server), 30 days maximum storage; 1,000 daily API queries[1] |
| Sophos XDR | per User; per Server[1] | Data Lake 20MB/day (User) or 500MB/day (Server), 90 days maximum storage; 1,000 daily API queries[1] |
| Next-Gen SIEM | per User and per Server[1] | XDR or MDR customers only; count must equal the XDR and MDR count; 1GB raw ingestion per day[1] |
| Identity Threat Detection and Response | per User and per Server[1] | Add-on for Sophos MDR and XDR[8] |
| Fusion Device Encryption; Fusion Mobile; Intercept X for Mobile | per User[1] | Mobile upload limits of 25 MB (documents) and 300 MB (apps)[1] |
| Sophos Email; Email Plus; Email Monitoring System | per User[1] | Counted by users and shared mailboxes[4] |
| Workspace Protection | per User[1] | Highest of three counts; ZTNA and DNS usage limits[1] |
| Sophos Phish Threat | per User[1] | Every recipient of simulated mail needs a licence[1] |
Sophos does not publish list prices for these products.
Metrics
The User metric means an employee, consultant or other individual who benefits from the Product. The Product does not have to be installed on that person’s own device.[1] A Server is a Computer on which the Product is installed, or which benefits from it, and which provides at least one application, client service or capability.[1] The definitions rest on benefit, not installation. An agentless or gateway-protected user can therefore still need a licence. Phish Threat makes this explicit: each user who is sent mail from Phish Threat benefits from the product and needs a User licence.[1] Catalog: Every Phish Threat recipient needs a User licence.
Workspace Protection uses a composite count, recorded as Workspace Protection entitlement count. Entitlement is based on the highest of three numbers: unique authenticated Protected Browser users, unique authenticated ZTNA users, or unique DNS agent installations. ZTNA in Sophos Cloud gateway mode is limited to an average of 15GB of data transfer per User per month. The DNS agent is limited to 15,000 queries per User per day.[1] The standalone Workspace Protection licence does not include Sophos Endpoint. Customers who want both buy Sophos Endpoint Plus Workspace Protection.[6] Catalog: Workspace Protection counted at the highest of browser, ZTNA and DNS counts.
Counting / floors
The Sophos Fusion help explains how the console calculates endpoint usage. Licence managers reconciling a position should know these rules:
- One user per device, per licence type. A device can be associated with only one user at a time, while a user can have several devices. Usage is calculated independently for each licence type. A user with one device on Sophos Endpoint and another on Sophos XDR uses one licence of each.[2] Catalog: Usage is calculated per user and per license type.
- Installer accounts. When an administrator signs in to install the agent, the device is first associated with the administrator. It moves to the next user who signs in.[2]
- Duplicate identities. Local workgroup accounts on two machines create two users in Sophos Fusion, each using a licence. The administrator can merge them to reduce usage.[2]
- Exclusions. Devices offline for more than 30 days are ignored. A deleted device stops counting 30 days after deletion. A device without real-time scanning turned on does not count toward Endpoint Protection usage. For Device Encryption under MSP Flex, a device counts only once encryption is configured.[2] Catalog: Devices offline for more than 30 days stop counting.
- Device-based entitlements. Where a customer is entitled to per-device licensing, the calculation is the same. Because a device carries one user, reported usage cannot exceed the number of devices, but it may under-count.[2]
The contract prevails. Where the in-product calculation differs from the EULA definition, the EULA definition takes precedence. If the product under-counts, the customer is licensed at its actual usage as described in the EULA.[2] The console does not enforce the licence limit, so a customer shown as over its limit can keep using and managing its products.[2] Contractually, any excess over the Use Level is invoiced.[9] Catalog: EULA definition prevails over the in-product usage count; Use Level is the Entitlement measured in Licensing Guidelines units.
Devices per User. Each User may use a reasonable number of Computers unless the product table sets a cap. Sophos may apply a cap where usage is unreasonable.[1] Catalog: Reasonable number of Computers per User.
Email. Sophos Email is licensed by the number of individual users and shared mailboxes that need protection. Mailbox aliases, distribution lists and public folders do not need licences. Usage is the number of mailboxes processed in the past 30 days, updated every four hours.[4] Portal Encryption add-on licences cannot exceed the number of Sophos Email licences.[4] When usage exceeds the licence, the account is flagged and an alert is sent, but all mailboxes stay protected. If nothing is done, the customer is contacted to reduce users or buy more licences.[5] Catalog: Sophos Email counts mailboxes processed in the past 30 days; Email over-usage is flagged, not blocked.
Next-Gen SIEM and data retention. The Next-Gen SIEM subscription count must equal the total number of XDR and MDR subscriptions. The Data Retention Add-On count must equal the Next-Gen SIEM count.[1] The Fusion Data Storage 1-year Pack covers only data sent to the Data Lake from XDR-enabled products. It is licensed on the combined number of Users and Servers.[1] Catalog: Next-Gen SIEM requires XDR or MDR and has a 1GB daily ingestion limit; Data Lake storage and query limits per XDR and EDR subscription.
Integrations. From 2025-11-01 for term licences, and late January 2026 for MSP Flex, all integrations were included with Sophos MDR and XDR subscriptions at no additional charge. Integration pack licences were retired at the same time.[8] Catalog: Integration packs included with MDR and XDR; pack licences retired.
Virtualization & partitioning
The Computer definition includes non-persistent deployments and virtual machines, and the hardware need not be owned by the customer.[1] Virtual servers are therefore Servers, and virtual desktops are counted like physical ones. Remote Desktop Services sessions are covered by a server licence without an Endpoint Protection licence.[2] Catalog: Computer includes virtual machines and non-persistent deployments. See virtualization and partitioning.
Cloud / BYOL
All the products in this article are managed from the Sophos Fusion cloud console. Workloads in public clouds are licensed as Servers where a server product protects them. The retrieved documents describe no bring-your-own-licence mapping for these products.
Programs
- Education, health and government. At Sophos’s option, per-User products may be licensed per Computer, or per mailbox for email products. A bundle mixing email and non-email products uses the higher of the Computer and mailbox counts.[1] Catalog: Education, health and government per-Computer entitlements revert to per User on transfer.
- Trials. Fusion trials last 30 days. After a trial expires, another trial of the same product can start only after 30 days. Trial accounts are limited to 1000 items per object type.[10] Evaluation licences generated by Sophos may show a date of 31 December 2999 but are still limited to 30 days.[1] Catalog: Trials and evaluations limited to 30 days.
- MSP Flex. MSPs using usage-based billing under MSP Connect Flex use the same per-user usage calculations.[2] See Sophos MSP Flex and partner licensing.
Expiry
When a full Endpoint licence expires, existing endpoints stop updating, new endpoints cannot be protected, policies cannot be changed and unlicensed products are uninstalled. When a trial expires, all licences are removed.[3] For Sophos Email, Sophos may allow up to 30 more days on a short-term temporary licence while the customer renews, and may charge for it. A renewal within that window starts from the day the previous licence ended.[5] Catalog: On termination or expiry all rights end and copies must be destroyed.
Out of scope
- Prices and discount structures, which Sophos does not publish.
- The Taegis XDR platform (per User, 4GB per month per User) beyond this mention.[1]
- Legacy on-premises endpoint products that have reached end of life.
- Consumer and home-use editions.