Lookout has stepped up MES security by requiring MFA (multifactor authentication) for local administrator authentication to access the MES console. After entering their username and password, local administrators must enter a one-time passcode generated by a mobile authenticator app.

While Google Authenticator is the preferred authenticator for MES, any authenticator that generates standard TOTP (time-based one time passwords) codes should work. Once set up, you must use MFA for any tenant to which you have access.

External administrators who access the console using SAML or SSO authentication from an IdP (identity provider) can only use MFA that is provided by their IdP. External admins using Intune Azure Active Directory integrations use their Intune AAD groups to assume MES administrative roles for Full Access, Restricted Access, and Read-Only Access. You created these mappings when first creating your tenant. If you need to change the AAD groups associated with each access level, contact Lookout Enterprise Support.