Skip to Content
Legal: Banner with Media - Background
For All Users

Licensing Guidelines

This document forms part of the Sophos End User Terms of Use available at https://www.sophos.com/en-us/legal, or other written agreement governing access and use of Sophos products and services. Capitalized terms not separately defined in these Licensing Guidelines have the same meanings as in the Sophos End User Terms of Use, or other written agreement, as applicable. Please refer to this archived Licensing Guidelines for any entitlements that were acquired or renewed before January 17, 2022.

Sophos Products are licensed or made available by the applicable units specified in the table below. The Schedule issued by Sophos specifies the number of applicable units that the Customer has ordered for each Product.

Sophos reserves the right to change or update these Licensing Guidelines at any time and the updated Licensing Guidelines will be effective when posted on the website.

The following definitions apply to the table below:

Definitions for Sophos Products

1.'Computer' means any device or computing environment which benefits from the Product (for example, but without limitation, workstations, personal computers, laptops, netbooks, tablets, smartphones, and environments connected to an email server, an internet proxy or a gateway device, or a database). The Product does not have to be physically installed on the computer environment to provide benefit, nor is there a requirement for the computing hardware to be owned by the Customer. The term Computer as defined herein includes, without limitation, non-persistent deployments, electronic devices that are capable of retrieving data, and virtual machines.

2. 'Server' means a Computer (i) upon which the Product is installed or (ii) which benefits from the Product, wherein the Computer provides at least one application, client service, or capability.

3. 'User' means an employee, consultant or other individual who benefits from the Product.
NOTE: The Product does not have to be physically installed on the User's computer environment in order to provide benefit to the User.

4. 'Cloud Asset' means a single virtual machine instance (including any server instance or database instance) or container image, within a Cloud Environment that benefits from, or whose configuration is accessed by, the Product. For the purposes of this definition, ‘Cloud Environment’ means an environment facilitating or involved in the delivery of computing services over the internet, including but not limited to Amazon Web Services (AWS) accounts, Microsoft Azure subscriptions, Google Cloud Platform (GCP) projects, Kubernetes clusters, development code repositories, and container registries.

Terms for Products

General exception for Education, Health and Government Entities:

If Licensee or Customer is an educational, health or government entity, Products or Services that are usually licensed or made available on a per User basis may alternatively, at Sophos’ option, be licensed or made available on a per Computer basis, or for email Products only, on a per mailbox basis. If a bundle includes both email and non-email Products, the aforementioned licenses must be the higher of the entity’s Computer and mailbox count. If Licensee subsequently transfers such Products or Services to an entity that does not fall within the education, health or government sector then the License Entitlement or Service Entitlement shall revert to calculation on a per User basis.

Number of Computers (Devices) per User:

In the case of Products licensed or made available by User, each User may use a reasonable number of Computers unless a specific cap on Computers per User is stated in the table below. Sophos reserves the right to apply a cap on Computers where usage is deemed unreasonable.

TRIAL/EVALUATION LICENSES

Where permitted, Customer may request a "trial" license or subscription of a commercially available Product for evaluation purposes. In some cases, "evaluation" licenses or subscriptions may be generated automatically by Sophos, in its sole discretion, for Customers of Sophos Central Endpoint Protection and Server Protection Products; for example, in order to enable testing of pre-release features and Products, and/or for applicable temporary license or subscription extensions.

All such trial/evaluation licenses and subscriptions, whether or not they are labelled as such, are governed by the terms of the Sophos End User Terms of Use, or other written agreement (as applicable) relating to trials/evaluations; are provided for temporary usage only; and may be used for no longer than thirty (30) days unless otherwise specified by Sophos in writing. Note: a non-applicable date of "December 31, 2999" may be displayed in the Sophos Central console for evaluation licenses or subscriptions that are generated by Sophos.

Sophos ProductLicensing ModelApplicable Unit(s)NOTES.EXCEPTIONS AND APPLICABLE LIMITS
Sophos Central Products
Cloud Optix AdvancedSubscriptionCloud Assets

A subscription includes a maximum number of Cloud Assets.
The following Data Lake use limitations apply:

  • 1MB daily storage per Cloud Asset with a maximum 90 days storage
Sophos XDRSubscriptionper Server

Following Data Lake usage limitations apply:

  • 40MB daily storage with a maximum 90 days storage per subscription; and
  • 1,000 daily Data Lake API queries.
Sophos EDRSubscriptionper Server

Following Data Lake usage limitations apply:

  • 40MB daily storage with a maximum 30 days storage per subscription; and
  • 1,000 daily Data Lake API queries.
Identity Threat Detection and ResponseSubscriptionper ServerAvailable to customers with Sophos XDR and Managed Detection and Response.
Sophos Endpoint for ServerSubscriptionper ServerN/A
Sophos XDRSubscriptionper User

Following Data Lake usage limitations apply:

  • 20MB daily storage with a maximum 90 days storage per subscription; and
  • 1,000 daily Data Lake API queries.
Sophos EDRSubscriptionPer User

Following Data Lake usage limitations apply:

  • 20MB daily storage with a maximum 30 days storage per subscription; and
  • 1,000 daily Data Lake API queries.
Identity Threat Detection and ResponseSubscriptionper UserAvailable to customers with Sophos XDR and Managed Detection and Response.
Sophos EndpointSubscriptionper UserN/A
Central Mobile AdvancedSubscriptionper UserMaximum upload size: 25 MB for documents, 300 MB for apps
Central Mobile StandardSubscriptionper UserMaximum upload size: 25 MB for documents, 300 MB for apps
Intercept X for MobileSubscriptionper UserN/A
Central Device EncryptionSubscriptionper UserN/A
Central Email AdvancedSubscriptionper UserN/A
Central Portal EncryptionSubscriptionper UserOnly available as an add-on for Central Email Advanced.
Sophos DMARC ManagerSubscriptionper UserOnly available as an add-on for Central Email Advanced.
Sophos Email Monitoring SystemSubscriptionper UserN/A
Workspace ProtectionSubscriptionper User

Workspace Protection includes the Protected Browser, ZTNA, DNS Protection, and the Email Monitoring System. Entitlement is based on the highest count of:

  1. unique authenticated Protected Browser Users;
  2. unique authenticated ZTNA users; or
  3. unique DNS agent installations.
    • ZTNA supports two deployment modes: on premise and Sophos Cloud gateway. Following usage limitations apply to Sophos Cloud gateway mode: Average data transfer of 15GB per month per User.
    • For DNS agent, the per-User query limit will be 15,000 per day.
Network Detection and ResponseSubscriptionper User and per ServerN/A
Central Phish ThreatSubscriptionper UserEach user who is sent mail from Phish Threat is considered to benefit from the product and requires a User license.
Sophos Firewall purchased on hardware appliance
Network ProtectionSubscriptionper hardware appliance 
Web ProtectionSubscriptionper hardware appliance 
Email ProtectionSubscriptionper hardware appliance 
Webserver ProtectionSubscriptionper hardware appliance 
Zero-Day Protection (for Sophos Firewall)Subscriptionper hardware applianceOnly applicable to Sophos Firewall
Xstream ProtectionSubscription
per hardware appliance

Only applicable to Sophos Firewall

The applicable use limitation(s) for DNS queries are provided below.

Firewall model Daily  
Query Limit 
XGS88(w), XGS87(w), XG86(w), Virtual Firewall - 1C4 license 310,000 
XGS108(w), XGS107(w), XG106(w), XG105(w), SG105(w) 390,000 
XGS118(w), XGS116(w), XG115(w), SW115(w), Virtual Firewall - 2C4 license 480,000 
XGS128(w), XGS126(w), XG125(w), SG125(w), Virtual Firewall - 4C6 license 600,000 
XGS138, XGS136(w), XG135(w), SG135(w) 830,000 
XGS2100, XG210, SG210 1,500,000 
XGS2300, XG230, SG230, Virtual Firewall - 6C8 license 1,900,000 
XGS3100, XG310, SG310 3,000,000 
XGS3300, XG330, SG330, Virtual Firewall - 8C16 license 4,800,000 
XGS4300, XG430, SG430 7,400,000 
XGS4500, XG450, SG450 12,000,000 
XGS5500, XG550, SG550, Virtual Firewall - Unlimited license 18,000,000 
XGS6500, XG650, SG650 32,000,000 
XGS7500, XG750 53,000,000 
XGS8500 120,000,000 

DNS is not included in any consumption-based licensing. 

Standard ProtectionSubscriptionper hardware appliance Only applicable to Sophos Firewall
Central OrchestrationSubscriptionper hardware appliance Only applicable to Sophos Firewall
FullGuardSubscriptionper hardware applianceOnly applicable to UTM
Basic GuardSubscriptionper hardware applianceOnly applicable to UTM
Wireless ProtectionSubscriptionper UTM applianceOnly applicable to UTM
Sandstorm (for UTM)Subscriptionper hardware applianceOnly applicable to UTM
UTM Virtual Software 
FullGuard Subscription per User When a User communicates with or through the gateway (including without limitation DNS and DHCP queries to the gateway and communications both to the Internet and a different LAN segment), their IP address is added to list of licensed devices in the gateway’s local database. If several Users communicate through a single device then every User is counted as a separate User. If an IP address has not been used in the last seven (7) days, it is removed from the database. 
Network Protection Subscription per User 
Web Protection Subscription per User 
Email Protection Subscription per User 
Wireless Protection Subscription per User 
Sandstorm Subscription per User 
Webserver Protection Subscription per User 
Sophos Firewall Virtual Software 
Base License Perpetual per virtual Computer Selection of licenses by number of CPU cores and amount of memory is available 
Network Protection Subscription per virtual Computer 
Web Protection Subscription per virtual Computer 
Email Protection Subscription per virtual Computer 
Webserver Protection Subscription per virtual Computer 
Xstream Protection Subscription per virtual Computer  
Standard Protection Subscription per virtual Computer  
Central Orchestration Subscription per virtual Computer  
Zero-Day Protection Subscription per virtual Computer  
Sophos Central Firewall Reporting 
Central Firewall Reporting Advanced Subscription GB storage capacity per Hardware appliance or per virtual Computer 

 subscription includes a maximum number reports generated per Hardware appliance or per virtual Computer as follows: 

Report time range Reports generated per month 
Last 24 hours 2000 
Last 7 days 1000 
Last 30 days 200 
Last 90 days 80 
90 days-1 year 20 
Other UTM Products 
UTM Endpoint Protection Subscription per User Sold in license packs 
Managed Services Licensing Model Applicable Unit(s) Notes and Exceptions 
Managed Detection and Response Essentials Subscription per User One subscription includes 1 license to Sophos XDR. 
Managed Detection and Response Complete Subscription per User One subscription includes 1 license to Sophos XDR. 
Managed Detection and Response Essentials ServerSubscriptionper ServerOne subscription includes 1 license to Sophos XDR.
Managed Detection and Response Complete ServerSubscriptionper ServerOne subscription includes 1 license to Sophos XDR.
Managed RiskSubscriptionper User and per Server

Available to Managed Detection and Response customers.
The following limitations apply per customer:

  • Asset Monitoring: 25 root domains
  • External Vulnerability Scanning: 1,000 IP addresses.
  • Internal Vulnerability Scanning: maximum number of IP addresses at 120% of customer's Managed Risk entitlement.
Emergency Incident ResponseSubscriptionper hourN/A
Incident Response RetainerSubscriptionN/AEntitlement includes a maximum number of device count applicable to customer's purchase.
Integration Pack Add-Ons and Data RetentionLicensing ModelApplicable Unit(s)Notes and Exceptions
Central Data Storage 1-year PackSubscriptionper User and per ServerAvailable to customers with Sophos XDR license (User and Server). Only data sent to Sophos Data Lake from Sophos XDR-enabled products. Central alert, report, threat graph, and audit data are not in scope. Licensed based on combined number of Users and Servers. 
Advisory ServicesLicensing ModelApplicable UnitNotes and Exceptions
Sophos Penetration TestingSubscriptionper tierOffered in Small, Medium, and Large tiers.
Sophos Wireless Penetration TestingSubscriptionper locationN/A
Sophos Web Application Security AssessmentSubscriptionper tierOffered in Small, Medium, and Large tiers.
Taegis Product and ServicesLicensing ModelApplicable UnitNotes and Exceptions
Taegis XDRSubscriptionper User

Following usage limitations apply:

  • 4GB data per month per User
Taegis VDRSubscriptionper assetN/A
Taegis MDRSubscriptionper UserN/A
Taegis MDR PlusSubscriptionper UserN/A
Taegis MDR EliteSubscriptionper UserN/A
Taegis MDR EnhancedSubscriptionper UserN/A
Taegis MDR for OTSubscriptionper UserN/A
VMS PlatinumSubscriptionper UserRequires quoting via calculator.

Amazon Web ServicesTM, AWSTM, GCPTM, Google Cloud PlatformTM, KubernetesTM, MicrosoftTM, and Microsoft AzureTM are property of their respective owners. Third-party company, product, and service names are used for identification purposes only, and do not imply endorsement.

Updated: 19 February 2026

Archived Versions