Hello,
I have an endpoint that I was able to get running the EAP 10.0.3 Big Sur agent. The agent was in good health and reporting normally until the next morning. It had pulled an update then within five minutes of applying the update it had disabled it's real time protection and was no longer in good health. The user is reporting repeating requests for full disk access and despite applying these key extensions and rebooting the agent keeps requesting them. It is showing the 10.0.1 version again and I cannot get it to pull down the update.
I have collected the SDU from the device and would be happy to share it out. Let me know if you need any additional information.
Thanks,
Andrew B.