When I received this device, it was still had the factory tamper proof seal intact on it's bag. However I broke the seal and took it out of the bag.
I originally purchased this to use for engineering some rack mounts. The original seller told me that the device is CLAIMED to somebody elses Sophos account.
I setup the Sophos to test with my own home network, and was able to register it to my network and install it as a standalone firewall. From there I performed a factory reset and restored it to the same condition it was before testing it on my home network.
I am not sure what the limitations are on this device in terms of functionality, it can be used locally but certain services and capabilities won't work without being registered to a Sophos Central account.
I did try to create a Sophos Central to see whether or not the device truly is claimed, but I kept getting errors trying to log in. And so I stopped messing with it. As stated, the original seller says it was claimed.
So sold as-is for parts or limited local use only.