Sophos All models error codes
Codes
- -1Error codeInvalid option, username empty or password empty
- 2Error codeFile does not exist or Password empty or Cert empty
- 5Error codeFailed to read/open file
- 14Error codeFailed to parse response
- 101Error codeFailed to send request to the server
- 120Error codeNo data returned from server
- 1016Error codeEnter user credentials
- 1101Error codeUser authentication failed. Please try again
- 9009Error code"Command not found" or "Executable failed to launch properly"
- AAS-6411Error codeWhen a custom Role-based access control (RBAC) role with a base permission set to Help Desk or Read Only, and full product permission granted only for DNS Protection, creates a DNS over HTTPS-enabled location with no endpoint policy assigned and subsequent attempts to edit (e.g., disable the Secure DNS toggle) or delete that location fail with a "500: error updating location" message. This occurs because the operation requires communication with the endpoint policy service, which the restricted role cannot access
- AND-2932Error codeOn some devices capable of Factory Reset Protection (FRP), we’ve noticed an FRP is not supported error when you turn on FRP via Sophos Mobile. This issue isn’t caused by Sophos Mobile
- AND-3174Error codeWhen enrolling an Android 14 device using the “Work Profile” method the enrollment fails with the error message “Can’t setup device - Contact your IT admin for help”.This only occurs if a “Managed Domain” Android Enterprise integration is used
- CEP-9756Error codeWhen a Central Admin Isolation is triggered, this can cause the endpoint response message to be dropped and a delay of over an hour before the next communication to Central. During this time it will appear as “Isolating” in Central. This is due to a race condition when responding to the command. It is isolated during this time
- CFR-2914Error codeLogging in to the Central Admin UI from the Partner Dashboard and creating a schedule from the CFR UI choosing frequency as monthly, the schedule creation will fail with a 400 bad request error. The issue is also happening when the schedule is created from the Logs and Reports page in central
- CFR-3614Error codeScheduled report generation is intermittently failing, regardless of the report type. For CSV reports, we support up to ~50 MB. If a customer attempts to generate a report exceeding this size, the report will be truncated, resulting in fewer rows. To include all 100K rows in the CSV report, they need to reduce the number of columns. The issue persists for PDF reports, although the failure rate has been reduced. Reports with large data volumes are more likely to fail in PDF format. We are actively working on a fix, which will be available soon
- COS-5806Error codeThe Global Exclusions tab under Managed Risk Settings in Sophos Central does not open when clicked. Steps to Reproduce: Log in to Sophos Central with SuperAdmin. Navigate to Managed Risk > Settings. Click on the Global Exclusions tab. Observe that the tab does not open or respond. Additional Context: The issue is reproducible on the account. Managed Risk: Internal scans are fully configured. External Scan settings set Contacts are set. Request for a support case: please collect screenshot of any error (where applicable) Save and collect the har file (data within the Network tab) Select the text within the Console window and save it separately to a text file. Please raise the information collected with our Technical Support team to further assist with resolving the issue
- COS-5871Error codeWe have observed cases where customers are provisioned without a domain configuration in place. This results in issues during scan setup. When attempting to complete the setup, the following error appears in Central: “Some settings were not successfully configured. Please complete the following sections and resubmit: Root domains.” Impact:Customers cannot complete the scan setup until the domain configuration is corrected
- COS-5978Error codeWhen configuring a Microsoft 365 Response Actions integration, the setup may fail with the error “Name already exists or is blank”, even though no existing Credential Manager entry or Response Action integration is present. This issue can occur when the same name was previously used while creating a Microsoft Graph Security API integration (note: must be v1, not v2) within the same sub-estate
- COS-6248Error codeSophos Engineering is aware of an issue where the initial setup of Microsoft 365 Response Actions in Sophos Central may fail during credential provisioning, even after successful Microsoft sign-in and admin consent. During the onboarding wizard, users may encounter the following error: shared.credential.provisioning.error.title shared.credential.provisioning.error.unexpected As a result, the integration is not created successfully on the first attempt. However, after a short delay, re-running the setup using the same previously created credentials allows the integration to complete successfully. This behaviour indicates that: Microsoft authentication and consent flow complete correctly The tenant configuration and permissions are valid The failure occurs during the post-consent credential provisioning phase Based on observed behaviour and supporting logs: No explicit provisioning failure or success event is consistently logged for the first attempt The issue appears tied to the timing / delayed availability of provisioned credentials
- CX-1810Error codeWhen attempting to submit a new Technical Support case directly from within the Sophos Central Dashboard (via Help > Support Center > Create a Support Case), the submission form may fail to complete and return a 400 (Bad Request) error. As a result, the support case is not created. Applies to Sophos Central Dashboard (Updated UI) Administrators attempting to raise a support case using the in-app submission form Workaround: While our engineering teams work on resolving this issue, please utilize the Support Assistant widget within Sophos Central (or on support.sophos.com) to help diagnose your issue and open a new technical support case on your behalf. Via Help > Support Assistant Documentation: https://docs.sophos.com/central/customer/help/en-us/AI/SupportAssistant/index.html
- ERF-1192Error codeIf experiencing a login issue, and the user in question is confirmed to have a role/login within the Sophos portal in question. Please do the following to help rule out an issue is with either A. the URL accessed, B. a problem with a bookmark, or C. an issue with a browsers cache data. All of which can affect a user's login experience outside of the control of Sophos. Open a new incognito browser session. Manually type/copy the portal URL in question below, into the browser, and attempt the log in. Do not use bookmarks or automation/auto login plugins. Central Dashboard - https://central.sophos.com/ OR https://cloud.sophos.com/ Note: all of the URLs below with the exception to the Partner Portal, can use either cloud or central in the TLD. Using the opposite from what is normally used can help bypass cache related issues in the same way using incognito or clearing cache will. Self Service Portal - https://cloud.sophos.com/manage/self-service Enterprise Dashboard - https://cloud.sophos.com/manage/enterprise/dashboard Sophos ID - https://id.sophos.com/ Also able to select/try logging into dashboards linked from Sophos ID. Partner Dashboard - https://cloud.sophos.com/manage/partner Pa
- ERF-1287Error codeCustomers who have our Central Adsync Utility installed on 2012 or 2008-based Operating systems are no longer connecting/syncing with Central. error seen In the UI - both on utility upgrade check - “Check for update failed: An error occured while sending the request” on sync attempt - “sync failed: This is often due to connectivity issues” In the ADsync log on utility upgrade check - “Error retrieving forest config from API. Details: System.NullReferenceException: Object reference not set to an instance of an object. on sync attempt - “Error Active Directory synchronization failed. Reason: System.Net.Http.HttpRequestException: HTTP 500: InternalServerError ---> CommandLib.HttpRequestCommand+HttpStatusException: Exception of type 'CommandLib.HttpRequestCommand+HttpStatusException' was thrown.” Workaround Until this issue is understood/resolved, the resolution is to install the Central ADsync utility onto an operating system newer than Server 2012/2008, or Windows 7/8.1
- ERF-1359Error codeThere is a known/expected behavior where the Central on-premises AD sync utility logs may show intermittent 500 errors: Information [Th 17] HTTP request to https://cloud.sophos.com/api/sessions error InternalServerError: HTTP 500: InternalServerError Error [Th 17] [domain]: Failed to poll sync job: HTTP 500: InternalServerError This error does not affect or interrupt scheduled syncs, and it can be ignored. Though if this error is seen with other/different errors, and syncing is impacted, this should be investigated further
- ERF-1429Error codeThere are some reasons why a Directory User is not sync’d into Central. Note that there are no errors or indications as to why a user is not sync’d into Central. Is the user configured to be sync’d in? Check fiters/groups in the related Directory Services sections to confirm the user in question should be seen/logged in. ADsync filters Entra ID filters Google Directory filters Once you have confirmed the user in question is part of the current sync, then check/follow known reason 2 If the Directory Users UPN/Primary email address is already associated to another Central User. (eg. the endpoint login for this user A, is linked/shown in user B.) Where - the ‘edit’ login section for a user - https://docs.sophos.com/central/customer/help/en-us/PeopleAndDevices/People/Users/UserProfile/index.html#logins Related KBA discussing how to move logins for reference: https://support.sophos.com/support/s/article/KBA-000007468 How to resolve - Remove any associated Endpoint logins that have been added to other users. by editing the users login, and moving the ‘assigned’ login, over to the ‘available’ login. Releasing a login that was linked to another user, will allow a new user to be created/syn
- ERF-1531Error codeSome Sophos Central administrators may observe an outstanding notification titled: "All sign in requires multi-factor authentication (MFA) to be enabled." When interacting with this notification: Clicking the Turn on link may cause the browser to display a continuous loading/spinning wheel and require a page refresh. Clicking the More info link redirects to a retired Knowledgebase article resulting in a "Page not found" error. This notification can be safely ignored and acknowledged/removed from your dashboard: Locate the notification banner on your Sophos Central Dashboard or via the Notifications / Bell icon located at the top right of the Sophos Central header. For more details on finding and managing notifications, refer to https://docs.sophos.com/central/Customer/help/en-us/ManageYourAccount/NotificationsCenter/index.html Click the three dots (...) menu on the right-hand side of the notification. Select Permanently Dismiss
- ERF-9862Error codeThere is a known expected behavior where it is not possible to reset a particular Administrator(s) MFA within Partner, Enteprise, or Central Dashboard. Error example 1: “An unsuccessful attempt was made to reset the multi-factor authentication methods the user had registered. Review the event details and online documentation regarding roles and access for more information.” Error example 2: "MFA reset failed. Retry the operation or review audit logs for more details." When someone has both a Partner Dashboard and a Central/Enterprise Dashboard login with the same email address, it will not be possible to reset their MFA within the UI unless the domain of the email address is verified within one of the Dashboards. This is designed to prevent cross-account MFA resets. If one or both of the Central Accounts have the domain verified (via the separate Verify Domains feature) then it is possible to utilize the MFA reset feature within either the Partner or Central/Enterprise Dashboard
- ESG-3532Error codeSchedules scans will detect any controlled applications during their scan. These will be listed as “allowed”, as they are not being executed. This means an application can appear in reporting as both blocked and allowed, due to scheduled scans
- ESG-3936Error codeThe reports "Endpoint Protection - Malware and PUAs blocked" and "Server Protection - Malware and PUAs blocked" include all results, both Endpoints and Servers, in the report
- ESG-4480Error codeAdding a “Lockdown” Exploit Mitigation exclusion from the Computer Events section fails with the error “Failed to update exploit mitigation exclusions”, followed by “Error adding application.”
- ESG-4995Error codeDue to the grace period of 30 days being applied to customer accounts the XDR Sensor installer download will be temporarily unavailable after downgrading from MDR Complete to MDR Essentials
- FIX-6957Error codeWhen connecting to an SSID using Google Social Login to authenticate, on iOS devices, after clicking the Google sign button, you are presented with a Google error that reports, “Access blocked: domain request does not comply with Google’s policies.” The reason is that Google has discontinued the support for embedded web views
- FIX-7303Error codeWhen configured using the local GUI on the AP6 Series access points we have seen email failures where the password schedule and syslog emails do not send from the access point
- IFI-1258Error codeCurrently there is a limitation which leads to the issue that only the first 50 entries will be exported to CSV irrespective of the number of clients. Development threads this as a feature request and will address it in future releases. But there is no ETA yet for this
- IFI-1308Error codeDue to an SSL error, the user can not log in to the network with social login credentials. We found that TLS1.2 is not available in the AP100 device
- IFI-4201Error codeCurrently, background automatic channel selection is not working. This means that an AP will not switch a channel even if it becomes too crowded or has too much interference
- IFI-4254Error codeDue to an UI issue, whenever you try to register more than one AP in the Wizard, the UI might show an error even though the registration works. Unfortunately, this affects a common workflow: a new customer wants to set up multiple APs in one go
- IFI-9101Error codeSometimes Current Network(SSID) under Accesspoint->Clients-> is displayed wrongly. Current Network info does not get updated immediately in Cloud UI , so there could be entry of previously connected SSID instead of current one. It takes around 4 to 5 minutes for the proper information to be updated under clients page
- IFI-9245Error codeLeibniz 2.0.0
- INT-1635Error codeThere is a known behavior seen specific to the Microsoft O365 Graph V2 integration, where the initial onboarding will show successful/green, but then 10 minutes later it will show red/ failed to provision. Currently, the initial onboarding workflow does not check if the required Microsoft license/feature is provisioned correctly. This check will occur after the first full sync, which takes place 10 minutes after the initial authentication success. This means while the initial setup shows green/successful, if the prerequisites/documentation are not completed, we will see the failure afterwards. The failed to provision error is a result of either 1. The environment does not have the correct Microsoft license associated to it, or 2. It has the right license, but the Microsoft Alerts and Incidents dashboard is not provisioned (see step 11 in the documentation: https://docs.sophos.com/central/customer/help/en-us/ManageYourProducts/ThreatAnalysisCenter/Integrations/Microsoft365/MSGraphSecurityV2/MSGraphV2Setup/index.html )
- ISH-1131Error codeBy default, Outlook's built-in security blocks images from unknown senders, which affects Sophos Phish Threat simulation emails. Campaign images may not display automatically when recipients open emails, requiring a manual "Download Images" action. Since Sophos Phish Threat uses hidden images to track email opens, blocked images prevent the platform from accurately recording when users open simulation emails, resulting in lower or inaccurate open-rate statistics. This behavior is expected due to Outlook's default security settings, designed to protect users from potentially unsafe content
- ISH-4002Error codeIn rare instances customers may report when sending a training campaign they get presented with a "Oops, that page can't be found" error when clicking the training links. The page may load after refreshing several times. Please wait and try the link again after some time. This scenario can be seen during a web server refresh on the hosting server, normally it takes a couple of minutes to refresh all the training and landing pages - if the link was clicked during that specific refresh time the error will be received
- ISH-4246Error codeIf a campaign is created with large number of users then there are chances of page gets hang and campaign never gets completed. Currently it is recommended to add less than 500 recipients at a time. This will be improved in the future
- ISH-6820Error codeMicrosoft currently provides no effective way for us to monitor and remove domains/URLs from the Microsoft Defender SmartScreen list. This means that the aforementioned feature is not compatible with our Phish Threat product
- ISH-7392Error codeThe following URLs are officially blocked in China. https://sophos-phish-threat.go-vip.co/https://staysafe.sophos.com This means that training content will not work properly. The only possible workaround would be for the affected users to use a tunnel-all VPN solution
- ISH-7960Error codeTaking Phish Threat Training via Smart Phones is not currently supported due to format supportability issue
- LAT-3741Error codeSometimes during the EDB enablement process, the conversion of the Central Super Admin to Enterprise Super Admin may fail. In that scenario, you will get an 'Authentication Failure' when trying to log back into your newly created Enterprise Dashboard
- LAT-4495Error codeIf the API credentials used are active and confirmed valid (this can be tested using postman or curl to do a basic whoami and tenent list query outside of Kaseya) and this continues to trigger this error - Please ensure that the following is open (without any regional restrictions) from your VSA server: Open traffic to and from kaseya.int100fra.ctr.sophos.com Ensure the following IP Addresses are whitelisted - 18.159.54.20 , 3.123.181.234 , 52.59.169.88
- LAT-4896Error codeCustomers (Central Dashboard and Enterprise Dashboard), as well as Partners (Partner Dashboard) - could see excess amounts of Audit log entries that reference both 'alerts:read' and 'endpoint-state:read'. What are these audit log entries? These are entries made by your Partner's RMM applications that utilize our Sophos plug-in/Management APIs. It is the Sophos Plugin running on the Partners Server that is the source of the request. (examples of some of the utilities: https://community.sophos.com/sophos-integrations/w/integrations ) Why do I see this in my Audit Log? The RMM Sophos software plug-in is polling all of the Partner's Customers. This currently includes any of the Partners customers who are either not managed by the Partner or are currently Trial/Evaluation customers. Our APIs handle the rejection of non-managed tenants by understanding the permissions embedded in the API token, and returning a 403 when the credential does not have permission for that tenant. This in turn results in an Audit log entry for access denied being logged in both the Central Dashboard (and the corresponding Partner and/Enterprise Dashboards) Can these entries be prevented? If the entries are onc
- LAT-4912Error codePossible errors seen (ADFS) "Failed to change IDP status" error attempting to add a new Identity Provider configuration. (Okta) Attempting to log in via SSO you receive an "Expected 200 OK, got: 403 Forbidden" error (Okta) After authenticating with Okta, the first Sophos login screen is shown (enter email), there is no visible error in the UI The error seen in the browser network tab would be ‘AADB2C90273: An invalid response was received’ When trying to access the Auth endpoint URL (…/oauth2/v1/keys) instead of getting a response with data back, an error is returned: “E0000006 - You do not have permission to perform the requested action” One known reason for these errors is that the customer’s local IDP server is either behind a firewall, or configured the IDP service to geo-block/ regionally restrict access, which prevents communication with Auth0 services hosted in Europe
- LAT-5720Error codeThere is a known error/behavior that will be triggered with each Sophos Automate plugin (or Sophos Kaseya VSA plugin) for any partner customers that are either Unmanaged Trial licensed Errors will be seen in the plugin logs “Failed API request for …. status code: 403 …. “ “Failed to retrieve Alert(s) for …. status code: 403 …. “ “Failed to retrieve Computers(s) for …. status code: 403 …. “ “Warning occurred while syncing tenant/endpoint” Specific to Automate Plugin: the Computers and Alert sections may show the orange warning message “Sync completed with some warnings” Note: This is the same known issue/behavior that can also be seen in a Customer or Partners Audit logs (see Known Issue item CPLAT-48961 below)