Surface 4 with SGN 8.0 and TPM 2.0

Hi all 

...Some questions

i've Surface Pro 4 with SGN 7.0 and TPM 2.0. When users fails to insert initial pin many time (lockoutmax 32 times ), the Surface went into lockout mode, I communicate to the user the challenge for unlocking and when user login on his desktop the new pin change request appeared and i see that LockoutCount is cleared, clear TMP is done automatically. After update to SGN 8.0 (on the same device) the new change pin request (after blocking and unblocking Surface) it does not look anymore, Lockedout does not change and I need to clear TPM module. This is the procedure as described on Sophos Article.

The same thing happens with either C/R or C recovery.

Why with SGN 7.0 the pin change automatically appeared, but with SGN 8.0 i must clear TPM?

How can I restore this feature, even using Windows policies?

A rollback of behavior is expected?

Thanks for all 

Franco