iCloud Private Relay detection only occurs the first time that a device connects to a network. When you switch between restricting and allowing iCloud Private Relay from your UEM, the user will need to forget the network on their device, and reconnect. After you reconnect, the new iCloud Private Relay settings will go into effect.