Some SEP clients are able to disable and others can't

I have some SEP clients that have the ability to right-click and choose disable.  While other computers in the same OU and the same policy version do not.  It seems like the client that can disable are ones that are new or reinstalled.  I don't understand how some computers can't and some can disable.  Am I missing something?  Client verions are 12.1.4013 BTW