The issue is Apple has changed the way the Filevault payload is installed on Catalina.    Under Systems Manager > Manage > Settings > (select your profile name) > Filevault   Enable the following:   CHECK Defer encryption until after reboot CHECK Defer enabling until logout 0 Maximum number of times users can bypass   Make sure you check your device into dashboard to pull down the new profile configuration settings then give your device a power cycle. ... View more