When Lookout creates a new tenant, that tenant does not automatically inherit the Default Policy Group settings. Instead, you must select the tenant in the Multi-Tenancy Admin Console and assign a default group, and then click "Apply Defaults" in the Protections module to copy the settings from the MT Admin Console.

If you do not assign a default group to a tenant, any devices in the Default Device Policy Group on that tenant inherit the tenant's Protection policy settings instead of those specified in the Multi-Tenancy Admin Console.

For instructions on setting up a default policy group, see Setting a Tenant's Default Device Policy Group.