Lookout supports three enrollment methods with BlackBerry UEM. Most deployments use the Company Managed Devices option, but you may wish to use one of the other two depending on your needs.

You can only choose one of the options below per Lookout tenant. If you wish to use more than one, you must have separate Lookout MES Console tenants for each, and you must maintain separate user groups in BES UEM for each enrollment method.

• Company Managed Devices: You can push Lookout for Work from BES UEM to devices that are either fully managed by the company, or have a work profile that is company managed.

• Mobile App Management (MAM) Without Enrollment: You can send Lookout for Work invitations to devices that aren't enrolled in BES UEM in order to secure BlackBerry Dynamics apps. Because these devices aren't managed by UEM, you cannot enforce MDM-based mechanisms such as compliance policies.

  If you wish to use this enrollment method, contact Lookout Enterprise Support and ask to enable BlackBerry Dynamics container blocking on your tenant.

• Dual Enrollment: You can push Lookout for Work from BES UEM to Android Enterprise devices with a work profile, and have users activate Lookout for Work on their personal profile in order to provide coverage across the entire device.

• Deploying Lookout for Work in Dual Enrollment mode requires a new activation on the device. You must either set up a new Lookout tenant for a subset of new users, or re-deploy Lookout for Work to all of your existing users and have them re-activate.