I noticed that macOS agents with Defender for Endpoint activated show 'Active (XProtect)' instead of 'Active (Defender)' in the defender portal. It would be helpful to identify devices that might miss Defender quickly if the UI displayed Defender status instead of XProtect when Defender is active.