Xcitium is providing protection against local changes that are done directly on the endpoint.
You can find this setting under Profiles → {choose appropriate profile} → Client Access Control → check “Enable local user to override profile configuration” option at the bottom.