We are about to integrate Lookout MES with Intune. If you have done this, did you or your engineering teams have any concerns with the permission scopes that Lookout requires? For example, User_Impersonation is required, and group.read.all is required instead of group.member.read.all.

If integrating Lookout MES with Intune, consider concerns about Lookout's permission scopes, such as User_Impersonation and group.read.all instead of group.member.read.all. 

These scopes are related to accessing information about groups in Microsoft Graph API. group.read.all typically grants read access to group information, while group.member.read.all grants read access to the members of groups. The specific requirements will depend on the functionality that Lookout MES needs in terms of accessing and managing groups within Intune.