Defender in Passive mode managed by ConfigMgr- Policies

We have Defender in Passive Mode enabled for few clients that have been on-boarded to Microsoft for Defender Portal and are reporting in. We used the packages from the portal to on-board devices.

Have created an AV Policy and applied to the devices which are a part of the group, however the policies are not getting applied, it says "This device isnt managed"

Currently the enforcement scope "security setting management "is not turned on and the devices show as managed by Config Mgr

Does turning on enforcement scope and tuning on Endpoint Security Profile Settings in Intune and Use MDE to enforce security configuration settings from Intune help in applying the established AV Policies. Additionally the on-boarded devices are part of AD Group and tagged.