device remain isolated despite being 'released' from isolation

We have a device running Defender for Endpoint that is behaving as if it is isolated (it only connects to DNS and specific Microsoft services over 443).  All other connections we can see are being blocked, according to the Windows Firewall log, despite it being set to allow all connections on all profiles.

We have been told by IT that the device has been released - a couple days ago - but it is still behaving the same way.  Is there a client-side mechanism available to reset the Defender configuration?

Initially we were unaware of the isolation & thought the issue was a general network adapter problem, so we have tried the usual things such as resetting the tcp/ip stack via netsh, resetting winsock, disabling or 'allowing all' in the firewall and network driver updates.

We know the hardware is OK as we have used a Linux live CD to test it.

I hope this is the correct 'Defender' forum for this post.