Enabling On-Device Threat Protection
On-Device Threat Protection blocks compromised devices in your fleet from accessing corporate or Web resources. By enabling this feature, you can use Block internet and alert or Block domains and alert as responses in your protection policy settings. The first setting blocks all internet access on a compromised device. The second setting blocks a list of domains that you can configure from this tab.
Some policy responses, such as OS Out-of-Date or Patch Level Out-of-Date only allow you to block certain domains, since the device needs internet access to resolve the threat.
Because On-Device Threat Protection runs as an always-on VPN, users must accept the VPN permission from the Lookout for Work app during setup, and the device cannot have another always-on VPN present.
To enable and configure On-Device Threat Protection from the Multi-Tenancy Admin Console: