I was having the same issue. I went and got the intune XML file for
defender and looked at what was in it.I think the MS article has a typo.
I changed this in my PPC policy. The MS article seems to be missing a *
after exists Not sure if this is the ...