@Jonny, Thanks for posting in Q&A.
According to your description, I know that on some users’ devices Intune flag them as non-compliant for real time protection policy.
Based on my researching, I found that Real-time protection policy is only available for Microsoft Defender Antivirus, if the devices owned other third-party antivirus software, it will show not compliant on this setting by default. For this scenario, you can exclude this compliance setting to check on these devices or users.
If the devices do not own other third-party antivirus software, based on my testing, I found that when you create a compliance policy and require Real-time protection, it needs the targeted devices turn on Real-time protection, if not, the device will be marked as non-compliant.
You can follow the steps below to check whether turn on Real-time protection, if not, please turn it on and try again.
Go to settings > click Privacy & security > click Windows security > click Virus & threat Protection > find Virus & threat protection settings and click Manage settings below > turn on Real-time protection.
Please try above information and if there is any update, feel free to contact me.
If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.