In short: Sophos licensing is subscription based. Sophos Endpoint is licensed per user (some customers per device) and servers per server, and each product's usage is counted separately. Licences are bought as fixed-term subscriptions or billed monthly through a provider on MSP Flex. Optional add-ons such as Next-Gen SIEM, ITDR, NDR and AI Defense sit on top of the main tiers.
How Sophos licences are counted
Sophos sells subscriptions, not perpetual licences, and its Licensing Entitlement and Usage Guidelines set the unit for each product: Sophos Endpoint, EDR and XDR per user, Sophos Endpoint for Server per server, and MDR, MDR Plus, NDR and Next-Gen SIEM per user and per server. For endpoint products, Sophos's licence usage FAQs explain the counting rules, which are worth knowing before a renewal:
- Per user, sometimes per device. Most customers are licensed per user; some are licensed per device. The calculation works the same way either way.
- One user per device at a time. A user can have several devices (a laptop and a desktop, for example) and still count as one user, but each device is associated with only one user.
- Each licence type is counted separately. A device counted for Sophos Endpoint does not automatically count for Sophos Device Encryption, which only counts once encryption is configured through an encryption policy.
- Servers are licensed per server under server protection, and remote desktop (RDS) sessions on a server are covered by the server licence.
- Stale devices drop out. Devices offline for more than 30 days do not use a licence until they reconnect, deleted devices stop counting 30 days after deletion, and devices without real-time scanning turned on do not count towards endpoint usage.
- Watch local accounts. Different local logins on different machines (two accounts called Jane, for example) appear as separate users and each use a licence; an administrator can reassign both sign-ins to one user and delete the spare.
The console shows a warning if you exceed your licence, but Sophos does not enforce the limit based on that in-product count, so you can keep working. Where the console's figure and Sophos's licence terms differ, the terms take precedence, and Sophos says usage the console under-counts is billed at your actual use. It pays to keep the count accurate before a renewal.
Term subscriptions or monthly MSP Flex
| Option | How it works | Suits |
|---|---|---|
| Term subscription | Bought for a fixed term for a set number of users and servers | Stable headcount and organisations that prefer one decision per term |
| MSP Flex (monthly) | Billed monthly through a managed service provider based on usage, with the provider running the tenant | Changing headcount, managed service customers and those who want to avoid up-front cost |
| Sophos Endpoint 100 | A fixed-price Sophos Endpoint offer for organisations with up to 100 users, covering computers and servers | Small businesses that want simple, predictable licensing |
Not every product reaches every route at the same time. The Sophos EDR tier, for example, went on sale for term licences in November 2025 and through MSP Flex from late January 2026, and the enhanced XDR, MDR and Next-Gen SIEM reached new term customers before MSPs. See Sophos Endpoint 100 for the small business option and its current eligibility rules.
Main tiers and optional add-ons
The endpoint and managed service tiers build on each other: Sophos Endpoint, Sophos EDR, Sophos XDR, Sophos MDR and Sophos MDR Plus. Our Sophos Endpoint editions page compares them. On top of those, Sophos sells optional add-ons:
| Add-on | What it adds | Works with |
|---|---|---|
| Sophos Next-Gen SIEM | Custom AI-assisted integrations, compliance dashboards and at least a year of retention as standard, extendable to 3, 5, 7 or 10 years; priced per user and server, not by data volume | Sophos XDR and Sophos MDR customers |
| Sophos ITDR | Identity threat detection and response for Microsoft Entra ID and Active Directory, licensed per user | Add-on for Sophos XDR and Sophos MDR |
| Sophos NDR | Network detection and response, licensed per user and server | Feeds Sophos XDR and Sophos MDR |
| Sophos AI Defense | Visibility and control of AI tool use, including shadow AI, licensed per user and server | Sophos EDR, XDR and MDR customers, delivered through Sophos Fusion |
| Sophos Endpoint for Legacy Platforms | Continued protection for eligible Windows and Linux systems after the operating system vendor's support ends | Add-on for Sophos Endpoint customers |
| Data retention extension | An extra year of cloud data retention | EDR, XDR and MDR |
| Portal Encryption | Encrypted email delivered through a secure portal | Add-on for Sophos Email and Sophos Email Plus |
| Sophos DMARC Manager | DMARC reporting and enforcement guidance | Add-on for Sophos Email; included in Sophos Email Plus |
| Fusion Firewall Reporting Advanced | Cloud reporting for your firewalls, licensed by storage capacity | Sophos Firewall |
From November 2025 Sophos stopped selling separate integration packs and included its third-party integrations in Sophos XDR and Sophos MDR, and the packs no longer appear in its licensing guidelines. If you are on MSP Flex, still check your position, because Sophos's integration licence help still describes integration licence packs for MSP Flex customers.
Renamed and retired Sophos products
If your renewal quote or console shows an unfamiliar name, this table maps old names to current ones:
| Old name | What it is now |
|---|---|
| Central Intercept X Advanced | Sophos Endpoint – User (renamed late 2025; listed as Sophos Endpoint in Sophos's licensing guidelines) |
| Central Intercept X Advanced for Server | Sophos Endpoint – Server (renamed late 2025; listed as Sophos Endpoint for Server) |
| Intercept X Advanced with EDR / XDR | Replaced by the separate Sophos EDR and Sophos XDR tiers |
| Intercept X Essentials | End of sale: last new orders 1 November 2025, last renewals 7 January 2026; customers move to Sophos Endpoint |
| MDR Essentials | Sophos MDR (renamed 2026) |
| MDR Complete | Sophos MDR Plus (renamed 2026) |
| Rapid Response | Sophos Emergency Incident Response |
| Central Device Encryption | Sophos Device Encryption |
| Central Mobile Advanced / Central Mobile Standard | Sophos Mobile / Sophos Mobile Device Management |
| Intercept X for Mobile (licence) | Sophos Mobile Threat Defense (the app keeps the Intercept X for Mobile name) |
| Sophos Central | Sophos Fusion (a rename of the console, not a licence) |
| Cloud Optix | End of life on 30 September 2026 |
| XDR and MDR integration packs | No longer sold from November 2025; integrations now included in XDR and MDR |
Renewal and true-up advice
- Check the expiry date in the console (profile menu, then Licensing) at least 60 days ahead. Sophos says that after a full Endpoint licence expires, existing devices stop receiving updates, new devices cannot be protected, policies can no longer be changed and unlicensed products are uninstalled.
- Clean up the device list first: remove retired machines and merge duplicate users so the count reflects reality.
- Map old names to new ones using the table above, so you renew into a current licence rather than an end-of-sale one.
- Re-check the tier. Renewal is the natural point to move between Sophos Endpoint, EDR, XDR and MDR, or to Endpoint 100 if you are small enough.
- Review add-ons and drop any you no longer use, such as integration packs that are now included.
- Consider the term. A longer fixed term suits a stable headcount; if your numbers change month to month, monthly MSP Flex billing through a provider may fit better.
How we help
We read your current Sophos licence position, reconcile it against what the console shows, and give you a written renewal or new-business quote with the current product names. If you are moving from another vendor, or consolidating several Sophos subscriptions onto one co-terminated date, we handle that too. For what drives the cost, see Sophos Intercept X pricing.
Ready to renew or want a second opinion on a Sophos quote? Contact us.
How Forever Systems supplies and supports Sophos
We supply and support the Sophos portfolio for UK organisations, from a single Sophos Endpoint (Intercept X) licence to a fully managed Sophos estate across endpoint, server, firewall, email, network and managed detection and response.
- Scoping and licensing: the right products, tiers and add-ons for your users, servers and risk, and a clear view of how the old Intercept X names map to today's Sophos Endpoint, EDR, XDR and MDR
- Deployment and migration from other endpoint, firewall or email products, or from older Sophos products and on-premises consoles
- Policy tuning so protection is strong without blocking legitimate work
- Ongoing support: alerts, health checks, updates, renewals and licence true-ups in Sophos Central (now becoming Sophos Fusion)
Forever Systems Ltd is an independent IT and cyber security provider. We also supply alternatives such as Cisco Secure Endpoint and Check Point Harmony Endpoint, so our advice is impartial.
Want a Sophos quote, trial or renewal review?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
How is Sophos Endpoint licensed?
Per user for most customers, with some entitled to per-device licensing. A user with several devices counts once, servers are licensed separately per server, and each Sophos product is counted on its own.
What happens when a Sophos licence expires?
For a full Sophos Endpoint licence, Sophos says existing devices stop receiving updates, new devices cannot be protected, you can no longer change policies and unlicensed products are uninstalled. Renew before the expiry date to avoid a gap.
What is Sophos MSP Flex?
MSP Flex is Sophos's monthly billing programme for managed service providers. The provider runs your tenant and you pay monthly for what you use, instead of buying a fixed-term subscription up front.
Is Intercept X Advanced still sold?
Not under that name. Central Intercept X Advanced was renamed Sophos Endpoint – User in late 2025, and the server licence became Sophos Endpoint – Server. The protection technology is the same.
Do I need to buy integration packs for Sophos XDR or MDR?
Generally no. From November 2025 Sophos stopped selling separate integration packs and included third-party integrations in Sophos XDR and Sophos MDR. Sophos's help still describes integration licence packs for MSP Flex customers, so check if you are billed that way.