EnableConvertWarnToBlock will not enable - stays False

The registry value in the screenshot is correct, so the GPO is writing the policy. However, that value alone does not mean the Defender engine can apply it.

EnableConvertWarnToBlock is a Network Protection setting. It only has an effect when Microsoft Defender Antivirus is running in active mode and Network Protection is enabled. Onboarded to MDE does not automatically mean Defender Antivirus is active; it can still be in passive mode if another antivirus product is registered.

Check these first:

Get-MpComputerStatus | Select AMRunningMode,RealTimeProtectionEnabled,NISEnabled Get-MpPreference | Select EnableNetworkProtection,EnableConvertWarnToBlock

AMRunningMode should be Normal, real-time protection should be enabled, and Network Protection must be enabled, normally in block mode. Configure that separately in GPO under:

Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus > Microsoft Defender Exploit Guard > Network Protection

Set Prevent users and apps from accessing dangerous websites to Enabled (Block). Then run gpupdate /force, restart the device, and check the two commands again.

Tamper Protection is not the likely cause here, so it does not need to be disabled. Also review Intune, MDE security settings management, or another Defender policy source for a conflicting Network Protection setting. A GPO can write the registry value while another management source prevents the effective Defender configuration from changing.

Finally, this policy applies to Network Protection warnings. If the intended browser is Microsoft Edge, configure the Edge policy Prevent SmartScreen Prompt Override as well; EnableConvertWarnToBlock alone does not control Edge SmartScreen override behaviour.