SeatReaper reads every computer and server in your active Sophos Central tenants, with when Sophos last saw it and the person associated with it. It never changes devices, policies or alerts.
Create API credentials
Use Sophos Central Partner to cover every client at once. Credentials from Sophos Central Enterprise, or from a single tenant, also work and cover just that account.
- Sign in to Sophos Central (Partner, Enterprise or the tenant) as an admin.
- Open API Credentials Management (under the settings area) and add a credential.
- Give it a read-only role, such as Service Principal Read-Only.
- Copy the client ID and the client secret. The secret is shown once.
Connect
An owner opens Settings > Integrations > Sophos Central, pastes the client ID and secret, and chooses Connect Sophos Central. SeatReaper signs in at Sophos, checks which kind of account the credentials belong to (shown on the card), saves them encrypted, and runs the first sync. After that it syncs every day, and Sync now checks at any time.
Each tenant's devices are read from that tenant's own Sophos Central address, which Sophos returns. SeatReaper only sends the credentials' token to Sophos addresses (id.sophos.com and *.central.sophos.com).
How devices are linked to clients
- Each active tenant is linked to the client with the same name (ignoring capitals, punctuation and endings like Inc or LLC), or to the client an owner or tech picks under Sophos tenants. A picked link is kept on every sync.
- A device in a tenant that is not linked still links to a client when exactly one client has a device with the same name in N-central, Datto RMM or Cove, or in a NinjaOne organization linked to a client.
Credentials from a single tenant have no tenant name to match, so pick the client for it under Sophos tenants.
What SeatReaper does with it
- Dead devices: a computer or server Sophos has not seen for the device threshold (60 days unless you change it) is flagged, but only if every other tool it appears in also considers it dead. One item lists every tool still billing for it. See What SeatReaper flags.
- Offboarding: Sophos devices appear in the device list when you offboard someone, with the associated person, and are confirmed once they leave Sophos Central.
- Prices: set your monthly cost per protected device in the price book.
Suspended tenants, and things that are not computers or servers (such as security VMs), are not read.
Disconnect
An owner chooses Disconnect on the card. SeatReaper deletes the tenants and devices it synced. Delete the API credential in Sophos Central to revoke access completely.
In compliance reports
On Growth and Pro, Sophos Central is one of the EDR tools in the Device inventory and gaps report in the compliance evidence reports. A device another tool has seen recently but no EDR tool knows about is listed as missing EDR.