The answer is the option does not exit on the client. You can only force a scan from the Cortex console, which means only IT staff with access to that can force the scan, the user can't do a scan. I had a colleague in our security team, who would get the allerts in the console and we would then contact the user so we could deal with it. No idea why it's like this, given he Windows version does allow scans.
