SCCM 1906 with Win10 1903 Clients - AV Policies Not Applying

[Manny-Tech]

I currently run an estate of 1803 devices where I allow staff laptops to be able to turn off real time protection temporarily if they need to for software installs. I have upgraded a number of devices to 1903 and although looking in Windows Defender it indicates the policy is being applied it actually just tells me that settings are managed by my system administrator and the options I'd expect to be able to toggle are greyed out. I've checked the registry key for LastAppliedPolicy and everything is in there that I'd expect albeit it just doesn't do as it's supposed to. Anyone else had a similar experience?

 

Problem doesn't seem to occur on 1803 and a couple of 1809 clients I trialled on too.