It can take up to 48 hours for a URL or IP address to be blocked on a device.

Create indicators for IPs and URLs/domains - Microsoft Defender for Endpoint | Microsoft Learn - 48 hours?

Thats nuts why would a company purchase this is you can't implement, or rollback change for 2 days? 

What if you're getting attacked and need to stop remote machines connecting to an IP\Domain.  2 hours to stop and attack?

Surely there is a way to force this.