Yes, for cloud management. A Sophos Central support and services subscription per AP is what unlocks Central management, firmware updates, Advanced RMA, and 24/7 support. The hardware itself carries a limited lifetime warranty, and you can run the local web interface for a single AP without Central, but most customers want Central so their Wi-Fi lives in the same console as the rest of their Sophos gear. Add the support term that matches your deployment when you order.

No. The AP6 420E ships as the access point only, with no power adapter or PoE injector in the box. It needs PoE+ (802.3at) to run, so you'll power it from a PoE+ capable switch or a separate PoE+ injector. If you're deploying more than one or two APs, a Sophos PoE+ switch is usually the cleaner option since you can manage the switch in Sophos Central alongside the access points. Ask us and we'll add the right power option to your quote.

There's no single number, because real capacity depends on your space, wall materials, and how the clients are using the network. As a general-purpose, medium-density AP, the 420E is built for rooms like retail floors, classrooms, and small-to-medium offices. For heavier client counts you'll usually plan several APs and let Sophos Central handle roaming between them rather than pushing one unit to its limit. Tell us your square footage and rough headcount and a Sophos-certified rep will help you size the deployment.

No. The AP6 Series, including the 420E, cannot be managed from any Sophos firewall. It's managed in Sophos Central, or through the local web interface for a single AP. If you specifically need a firewall to act as the Wi-Fi controller, that's the end-of-sale APX Series, which Sophos has set for end-of-life on December 31, 2027. For any new install we'd point you to the AP6 420E and Central rather than starting on hardware that's already sunsetting.

The "E" is the difference. The AP6 420E is a tri-radio access point that adds the 6 GHz band for Wi-Fi 6E clients and includes a 2.5G uplink port. The standard AP6 420 covers the 2.4 and 5 GHz bands only and uses a 1GE port. If you have newer devices that can use 6 GHz, or you want the faster uplink to avoid a bottleneck, the 420E is the one. If your clients are all on 2.4 and 5 GHz, the 420 does the job for less.

Yes, and it's the right direction to go. The APX Series is Wi-Fi 5 and end-of-sale, with an end-of-life date of December 31, 2027, so any refresh should move to the Wi-Fi 6/6E AP6 Series. The 420E is a strong indoor replacement that adds WPA3, the 6 GHz band, and a 2.5G uplink. One thing to plan for: APX was often firewall-managed, while AP6 runs in Sophos Central, so budget a Central support subscription per AP as part of the migration. We can help map your existing APX units to the right AP6 models.