Set up your Ivanti EPMM Connector in the Lookout Mobile Endpoint Security Console
Once you have configured Ivanti EPMM, you can set up a connector in the Lookout MES Console. If you have multiple tenants, you must repeat the following steps to connect to each of them:
- Log in to the Lookout MES Console at https://app.lookout.com.
- In the left sidebar, click Integrations.
- Under Choose a product to set up, click the Ivanti EPMM tile.The Ivanti EPMM connector page opens.
- Under Connector Settings, enter the following:
Field Value Label for this MDM connection (Optional) A user-friendly name for the connector.
If you have multiple connectors configured, this label displays in the MDM column of the Lookout MES Console Devices list so that you can determine which connector and MDM instance a device belongs to.
Ivanti EPMM URL Your Ivanti EPMM URL, https://<URL for your Ivanti EPMM>Username Enter the User ID and Password from Creating an API User Password - (Optional) To route Lookout traffic through a proxy, enter the proxy address and credentials in the
Proxy Settings fields.
- Click Create Integration in the top right corner.
If creation is successful, a banner notification appears and additional sections become enabled. If you get a certificate error, click Certificate Details. Otherwise continue with Step 7.
- Look for errors on the certificate details screen.Typical errors include expired or broken certificates as shown here:
Error How to Fix the Error Expired certificate The certificate expiration date is in the past. Replace the MDM certificate with a new certificate. Error How to Fix the Error Broken certificate. One or more intermediate certificates do not validate correctly. Replace the MDM certificate with a valid certificate. - Retry entering all required information into the Integration connector.
- Look for errors on the certificate details screen.
- Scroll down to Enrollment Management and enter the following:
Field Value Automatically drive Lookout for Work enrollment on Ivanti EPMM managed devices ON Use the following label to identify devices that should have the Lookout for Work app activated Select your enrollment label from Creating a Label for Enrollment. This should be Lookout for Work. How often should Lookout check for new devices? Lookout recommends using the default 5 minute interval. Automatically send activation emails to Ivanti EPMM managed devices OFF
For an MDM integration, you should drive enrollment through your MDM, not via Lookout MES Console invitation emails.
Delete device on unenrollment ON Automatically deactivate Lookout on select devices ON Deactivate Lookout on devices with any of these Ivanti EPMM statuses Check all (Lost, Wiped, and Retired) - Scroll down to State Sync and enable Synchronize device status to Ivanti EPMM.
- Set the toggle Override Labels with Custom Attributes for State Sync to use labels (Off) or custom attributes (On), matching what you configured in Creating Custom Attributes for Device State Sync or Creating Labels for Device State Sync.
- Select the custom attributes or labels you configured in Creating Custom Attributes for Device State Sync or Creating Labels for Device State Sync.
If you choose not to synchronize a specific state to Ivanti EPMM, leave the corresponding toggle off.
- Device Status:
Field Value Devices that have not activated Lookout yet MES - Pending Devices with Lookout activated MES - Activated Devices with Lookout deactivated MES - Deactivated - Connection Status:
Field Value Devices that are unreachable by Lookout MES - Unreachable Devices that have lost connectivity with Lookout MES - Disconnected - Risk Status:
Field Value Devices with any issues present MES - Threats Present Devices with low risk issues present MES - Low Risk Devices with medium risk issues present MES - Moderate Risk Devices with high risk issues present MES - High Risk Devices with no issues present MES - Secured
- Device Status:
- If you have purchased the feature to add specific Risk Classifications to synchronize with your MDM you can add them using this procedure.Otherwise continue on to step 12.
If you purchased the feature to add Risk Classifications to synchronize with your MDM, a Risk Classification section is visible in the Lookout connector.
- In your MDM, follow the steps in Creating Custom Attributes for Device State Sync or Creating Labels for Device State Sync to define an additional custom attribute or label for each risk classification you want to synchronize with your MDM.Here are some examples:
Example Risk Classification Example Custom Attribute or Label Example Description Phishing and Content Protection Disabled Lookout MES - PCP Disabled Devices with PCP disabled VPN Permission Not Accepted Lookout MES - VPN Prohibited Devices with VPN Permission not accepted - In the Lookout connector Risk Classification section (visible only if you purchased this feature), follow these substeps:
- Click Add Risk Classification.
- Set to Enable.
- Choose the desired risk classification from the dropdown to synchronize with your MDM.
Risk classification synchronization occurs only if a state sync event occurs.
- Choose the custom attribute or label for the selected risk classification from the dropdown to synchronize with your MDM.
If you choose not to synchronize a specific state to your MDM, leave the corresponding toggle off.
- Repeat steps i - iv for each additional risk classification you want to synchronize with your MDM.
Each risk classification you add here must have a corresponding unique custom attribute or label defined in your MDM.
- In your MDM, follow the steps in Creating Custom Attributes for Device State Sync or Creating Labels for Device State Sync to define an additional custom attribute or label for each risk classification you want to synchronize with your MDM.
- Scroll down to Error Management and enter an email address for error reporting.
- (Optional) Scroll down to Group Management and enter a Lookout MES Console Device Group for new devices from this connector.
By default, new devices are added to the Default Group in the Lookout MES Console. For more information about Device Groups, see the Lookout MES Console Administrator's Guide.
- Scroll up and click Save Changes in the top right corner.
You can review connector settings from the Integrations module at any time.
- If you are running multiple Ivanti EPMM tenants, repeat these steps to create one connector per tenant.
