Inheriting Default Organization Policies on Tenants
When Lookout creates a new tenant, or when you first set up multi-tenancy for an existing environment, all individual tenants use a local "Default Group" specific to the tenant to determine policy settings. Any additional groups start out with the local "Default Group" settings.
IMPORTANT: Initially, there is no relationship between your organization-level settings and the settings on each tenant. Until you assign a default policy group to a tenant as documented in Setting a Tenant's Default Device Group, the tenant retains its local settings.
Once you set a default policy group for a tenant from the MT Admin Console and click Reset Defaults in the tenant, the tenant links to the MT Admin Console. If you make changes to the tenant's default policy group in the MT Admin Console, those changes are pushed to the tenant automatically.
In the example below, the Lookout Tenant 1: USA tenant does not yet have a default policy group specified in the MT Admin Console. This is the expected status for tenants when you are first setting up your multi-tenancy environment.
All protection policy settings continue to behave exactly as they do on a standalone tenant. The USA Execs group takes default settings from the Default Group on the tenant, and none of the settings are affected by changes in the MT Admin Console:
To push policy configuration from the MT Admin Console, assign "USA Default" as the default policy group and click Reset Defaults on the tenant. This deletes the original Default Group on the USA tenant. The Protection settings on the tenant become linked to the settings in the MT Admin Console.
If you change the either "USA Default" or change "Default Policy Group" settings in the MT Admin Console, the changes affect the "USA Default" group on the USA tenant. In addition, the "C-Suite" group inherited settings are now taken from "USA Default":
