Advice regarding Sophos Central and "Server Protection"

Hi Mark Smith6 

The feature which you need is available in the role management under global settings. You can add the customer role where one user can have access to server protection only where he has admin rule for server protection product but he can't change anything in the other product group.

Please make sure you have one user that is in super admin rule, so when you want to change any role for any of the users, you can do that without any issues.

Please refer to this document which has information regarding this topic.

Hi Jasmin, 

Thanks for your reply and assistance. That is what we've done already, the current new role for Server admin has these permissions:

However, it cannot amend/create any new policies and I'm told if they tick the box in here for "Access policy management" it will allow access to all policies, not just the server ones. IS that correct or because this role only has the "server protection" enabled we'll only be able to administer those policies?

Additionally I'm unable to create/manage Groups. If I go in to "Server Protection - Server - Server Groups" Then I can see a single group that's been created but cannot manage membership of it and there's no option to add any other groups. 

Hi Mark Smith6 

As per the screenshot, you choose Help Desk as the Base role, administrators with the custom role have Help Desk permissions, hence it will have read-only access for all settings in Sophos Central. You can restrict access for a custom role to a specific product. This custom role allows any administrators assigned to this role to access Server Protection with Help Desk permissions

Hi Shweta, 

Just to confirm the base role should be "FULL" and then because we only select the "Server Protection" with access then we'll be able to add/amend policies and server groups?

Unfortunately I cannot test it so need to raise a request with the relevant team first. 

Thanks

Mark

Hi Mark Smith6 

You just need to enable the policy management in the global settings for Sophos central admin which will allow you to edit, apply policies to users and also will allow you to manage user, machine groups. I tested it and please refer my settings below which I kept for the user:

Hi Jasmin,

Won't that give the person in the "Server role" access to all of the policies though, including the "Desktop" ones? That's my current problem. 

I've now had the base permission changed to "FULL" and can add and amend server policies but not fully. I.e. I can't see any way to add an exclusion. If I look at the global exclusions it says to do it for an individual or group of devices to do it in the Policy but there's no option. 

Is that my permissions? 

Also I'm still not able to manage the server groups? There's just no buttons to add/delete them and I can't change membership of the one that's there. 

Thanks for all the help so far, it's appreciated. 

Hi Mark Smith6 

Global exclusions and other shared features will not work till endpoint, server both have full access for that user.

Unfortunately, it is also applicable to server groups as well. You can only edit the server groups if you have full access to endpoint protection.