Sophos MSP Flex and partner licensing covers how managed service providers (MSPs) license Sophos products that they use to serve their own customers, which Sophos calls Beneficiaries. The End User Terms of Use grant rights only for a customer’s internal information security purposes. They prohibit timesharing and service bureau use of the Product.[10] Service providers instead sign the Sophos Managed Service Provider Agreement, which offers two ways to buy: advance term subscriptions per Beneficiary, or the MSP Flex monthly billing arrangement.[1] Sophos firewalls can also be supplied to MSPs as Hardware as a Service (HWaaS), which is billed through MSP Flex.[2] For the general model, see subscription and consumption licensing.
Editions
| Model | How it is bought | Catalog |
|---|---|---|
| MSP term licences | Advance subscription for each Beneficiary; the Schedule states the Users or other units[1] | MSP term licenses |
| MSP Flex | Actual usage across all Beneficiaries, billed monthly in arrears, with a minimum commitment[1] | MSP Flex |
| Hardware as a Service | Firewall hardware with an Xstream Protection licence, 12-month minimum, monthly billing[2] | HWaaS |
MSP Flex has its own subscription codes. After Intercept X Essentials was withdrawn, the CIXE-MSP and SVRCIXE-MSP subscriptions were upgraded automatically to Sophos Endpoint subscriptions CIXA-MSP and SVRCLOUDADV-MSP. Monthly bills reflected the change from February 2026.[8] Sophos Email can also be bought as a Monthly Flex SKU, and the same licensing rules apply as for term purchases.[5] New tiers usually reach MSP Flex some time after term licences. Sophos EDR, for example, was available for term licences from 2025-11-01 and for MSP Flex from late January 2026.[8]
Metrics
MSPs use the same product units as end customers: User and Server for Sophos Fusion products, and Hardware appliance or Virtual Computer for firewalls. MSPs with usage-based billing under MSP Connect Flex use the same user-based usage calculations as other customers.[4] There is one exception. Under MSP Flex, a device counts toward Device Encryption usage only once encryption is configured, not when the product is merely installed.[4]
Flex partners manage virtual firewalls by size. A size such as 16C24 means 16 cores and 24 GB RAM, and Flex partners can change the size and subscription of their virtual firewalls in Sophos Fusion Partner.[3]
Counting / floors
MSP Flex billing. MSP Flex is a monthly billing arrangement for MSPs that meet the MSP Program requirements and have Sophos approval.[1] After a Ramp Up Period of six calendar months, the MSP Flex Partner pays the greater of two amounts: its total actual usage across all Beneficiaries for the month, billed in arrears, or its Minimum Monthly Commitment.[1] The Minimum Monthly Commitment is USD 200 (or the local equivalent), or a higher amount agreed with Sophos.[1] During the Ramp Up Period the MSP pays actual usage only, unless it agreed to a special minimum.[1] Catalog: MSP Flex pays the greater of actual monthly usage or the minimum commitment.
Volume bands and switching off. Where the MSP Flex Price List has volume bands, the band depends on the MSP’s total usage across all Beneficiaries for the product category. A request to stop payable usage may take effect only from the 1st of the following month, when the usage becomes a 30-day trial. If the MSP pays late, Sophos may require it to go back to advance subscriptions.[1]
Term licence overage. An MSP on term licences must buy advance subscriptions to cover each Beneficiary. If a Beneficiary’s usage exceeds the Schedule, the MSP must immediately buy the extra entitlement for the rest of the term.[1] Catalog: MSP term overage must be bought immediately for the remaining term.
Converting firewall licences. An active or expired term firewall licence can be converted to an MSP monthly licence. Any term value left on the existing licence is lost when the monthly licence replaces it.[2]
Programs
Hardware as a Service. HWaaS has a 12-month minimum commitment with monthly billing. It is not a term contract and does not need renewal, because it uses MSP Flex licensing, and it has no maximum term. After the 12 months the partner can end the service and stop billing. If the partner deactivates a device earlier, Sophos keeps billing it until the commitment ends.[2] The partner owns the hardware from the start, can move it between customers, and must buy replacement hardware to upgrade. Sophos does not replace HWaaS hardware at end of life.[2] In Sophos Fusion Partner, an HWaaS device’s customer can be assigned once but not changed. Its subscription cannot be changed because it is tied to a specific bundle.[3] Catalog: HWaaS has a 12-month minimum commitment billed monthly.
HA under MSP Flex. For active-passive firewall pairs under MSP Flex, advance hardware replacement for the passive firewall requires an Xstream Protection licence.[9]
MDR through MSPs. The MDR Service Description applies to MSPs as well as direct customers. The MSP acts as the contact for its Beneficiaries, obtains their consents and indemnifies Sophos for claims that result from its own failures. The MDR Plus SLA and its service credits apply per Beneficiary, and credits go only to the MSP’s account.[6] The standard MDR Plus Breach Protection Warranty does not apply to MSPs or their customers.[7] See Sophos MDR and security services licensing.
Contract terms
Transfers. An MSP may not assign or transfer licences or subscriptions to a Beneficiary or any other third party without Sophos’s prior written consent.[1]
Usage reporting. Sophos monitors use of the Offerings to track usage and entitlements. Where it lacks enough information, the MSP must report on request: each Beneficiary’s name and location, the licence numbers allocated to it, and the number of Users (or other units) per Beneficiary in the previous calendar month.[1]
Audits and compliance
The MSP audit clause is broader than the end-customer clause. No more than once a year, Sophos or an independent certified accountant it appoints may inspect the MSP’s premises, books and records on reasonable written notice. Any underpayment must be paid within 30 days of invoice. If the underpayment exceeds 5% of fees due, or the audit finds a breach of the use restrictions, the MSP also bears further costs as the Agreement sets out.[1] End customers, by contrast, can be audited only where Sophos cannot track usage.[10] Catalog: MSP term overage must be bought immediately for the remaining term. See software license audit.
Out of scope
- MSP Flex price lists and volume band thresholds, which are available only through the Partner Portal.
- The Sophos Partner Agreement for resellers and the MSP Program requirements for MSP Flex approval.
- Distributor terms that apply when an MSP buys through an authorized Sophos distributor.