We have just deployed MDATP and are looking at EDR in block mode but need Defender AV in passive mode and updating for this to work. Can we deploy an Endpoint Protection policy from ConfigMgr with just the Cloud Protection and Security Intelligence updates configured? Right now MDATP is showing the AV as disabled and not updating which appears to be because of a massively outdated engine and there being no update schedule defined.
@SimonR Did you ever figure this out? We are in a similar boat here, trying to run defender in passive mode w/ EDR block mode enabled. Except, Defender is NOT moving into passive mode that I can tell when running the get-mpcomputerstatus cmdlet.
