On-Device Threat Protection blocks compromised devices in your fleet from accessing corporate resources. When the feature is enabled, you can optionally configure a list of blocked domains. You can also block internet access entirely for such devices. Because On-Device Threat Protection runs as an always-on VPN, users must accept the VPN permission from the Lookout for Work app, and cannot have another always-on VPN present on the device.

Setting up a list of blocked domains allows you to block users from corporate sites when they have an active threat. This is especially useful in cases where your device fleet has a large number of Bring Your Own Device (BYOD) devices and you want to protect corporate data without cutting off all internet access to end users.