Defender ATP and Defender Antivirus

We are looking to replace our current AV provider (CrowdStrike) with Defender ATP on our workstations.  Currently all of our Workstations have Windows 10 and have been onboarded into ATP with CrowdStrike still installed.  My understanding is that when we remove CrowdStrike, Windows Defender Antivirus will then go into active mode as opposed to passive mode that it is currently in.  Is that correct?

So far as configuring Defender Antivirus settings we are currently using SCCM so we would configure that by making an Anti-Malware policy?

Thank you.