Unable to apply ASR policies to Win 10/11 endpoints from endpoint portal for SCCM managed devices

[KashifKloudy]

We have on-boarded windows 10/11 endpoints to MDE. Devices are managed by SCCM and on-boarded to MDE using SCCM however AV, EDR and ASR policies we are trying to push from Endpoint portal to utilize the MDE security management capability. AV and EDR policies were applied to the devices however ASR policies are showing "Not Applicable". 

We checked further and found: Microsoft Defender for Endpoint: Push ASR rules with Security Settings Management on managed devices but this does not talk about devices which are managed by SCCM. Hence, I wanted to ask community member if this is not possible to push ASR policies via endpoint portal when devices are managed by SCCM.

[#2]

@KashifKloudy how are you assigning the policies? I believe for this feature to work one needs a dedicated Azure AD group with relevant tagging on the devices. Any reason why co-management is not being used?

[#3]

Yes, we are using device tagging in MDE and connection between MDE and Endpoint portal is done already. we created security group where in MDE on boarded devices are added to the group on which we are pushing the ASR policy. Co-management is not set up yet as the customer is in intune testing phase currently and all devices they are managing using SCCM only. Just policies are being pushed via endpoint portal as a security management feature of MDE

[#4]

There are limitations to what all you can manage the Defender security management. I will advise to setup co-management and enroll and enable the endpoint security workload just for your pilot devices. Also, what is the SKU for the Windows devices that you are trying to manage?

[#5]

Windows 10 pro and win 11 devices are in pilot which are supported as per prerequisites for mde. And we have plan to on board 6k+ devices to mde however ASR policy is currently a blocker.