Endpoint license usage and calculation FAQs

Yes. This is to help avoid overcounting when one administrator sign-in is used for installation, but the regular user uses a second non-administrator sign-in. In this way, the license usage is limited to the currently signed-in user.

RDS sessions are no longer included in Server Protection and no longer reflect on the Endpoint Protection license count.

• License calculation may differ from the true usage according to the Sophos End User License Agreement (EULA).
• If there is a disparity between the in-product calculation and the EULA definition, the EULA definition takes precedence.
• If the product under-calculates usage, you'll be licensed at your actual usage as described in the EULA.

• In some circumstances, usage calculation may not be correct. You may be shown that you exceeded your license limit. When this happens, you can continue using and managing your licensed products within Sophos Central.
• The license limit isn't enforced based on the usage calculated within the product to allow for inaccuracies in the calculation.

• Devices offline for more than 30 days are ignored to avoid broken or re-imaged devices from continuing to count toward license usage.
• If real-time scanning isn't turned on, a device doesn't count towards Endpoint Protection license usage.

1. In Sophos Central, go to Reports.

2. Under Reports, click Users.

   In the Users page, you can see which users are taking up licenses. You can sort or view all the online or active users on the device from the last 30 days. While this list may not be a true license report, this will help give a more accurate list of the users using Endpoint Protection user licenses.

   For Intercept X and MDR license types, you can also view which devices you have assigned those features to on the Manage Endpoint Software page. See Computers.

   For Device Encryption license type, you must have an Encryption policy assigned to your device with encryption turned on. See Device Encryption Policy.

If an account has one user and one associated device, the license usage is calculated as one. The license usage will drop to zero if the device is deleted, even though the user remains on the account, because the user no longer has a device associated with them.

If the device is offline for more than 30 days, it will no longer consume a license, and the overall license usage will drop by one.

Devices are seen as offline if the Sophos application has been uninstalled but not deleted from Sophos Central or if the device no longer exists or has been re-imaged. The 30-day limit prevents the usage count from increasing indefinitely while avoiding frequent variations in usage based on common scenarios like holidays. If a device is deleted in Sophos Central, it immediately stops contributing to the usage count. The Sophos application must be re-installed for the device to be managed again.

Yes. A user with two devices, for example, one using Endpoint Protection only and one running both Endpoint Protection and Intercept X, will use one Endpoint Protection license and one Intercept X license.

A device can only be associated with one user at a time. When the administrator signs in to a device to install a Sophos application, the device will initially be associated with the administrator and contribute to the license usage. When the installation is complete and the same administrator signs out, the device and its license will be associated with the next user who signs in.

A device can only have one associated user, but a user can have more than one device.

Yes. If a user signs in to two devices using the same login credentials, for example, domain login, one user will be shown in Sophos Central with two associated devices.

If a user signs in to two devices using different login credentials, for example, Windows workgroup local accounts computername1\Jane and computername2\Jane, there will then be two users created in Sophos Central. Each user will have one associated device and one license. This is expected behavior because Sophos Central can't tell that the two sign ins are the same person.

The administrator can reassign the two sign-ins to one user, associating both devices to one user, reducing the license usage. Optionally, the user with no sign-ins can be deleted.

Here's an example: An organization with 100 users and 50 devices may be entitled to buy a license for 50 users. A device can't be associated with more than one user at a time. The maximum usage will be 50 if every device is associated with a different user. It can also be fewer if some users have more than one device associated with them. Therefore, while calculated based on users, the calculated usage can't exceed a licensed figure based on device licensing.

No. For example, if an administrator only installed Intercept X Advanced on a device and didn't include Device Encryption, the following details are seen in Sophos Central when the original user of the device signs in:

• Two active users. The active users are the administrator who installed the Sophos product and the original user.
• One active device.
• One license used for Intercept X.
• Zero licenses used for Device Encryption.

The Sophos Central Dashboard helps an administrator identify if devices need attention, for example if there's an incomplete Sophos installation or deletion of devices or user accounts that are no longer needed. This information are also used in Hero Reports.

License usage is shown on the Licensing page, on the licensing panel of Hero Reports, and on the Partner Dashboard.