Hi,
Thanks for posting in TechNet.
Could we check what version of the client is? If the version is Windows 10, please verify the order of source for downloading definition update. Navigate to gpedit.msc-> Administrative Templates-> Windows Components-> Windows defender Antivirus->
Signature updates. Here is the screenshot we could refer to:

As we choose source as WSUS, the tab of InternalDefinitionUpdateServer is in front of the tab of MicrosoftUpdateServer. Besides, we could check the source of update by Windowsupdate.log.
In the following screenshot, the source of update is from the WSUS.

Thanks for posting in TechNet.
Best regards,
Amanda You
"MECM" forum will be migrating to a new home on
Microsoft Q&A!
We invite you to post new questions in the "MECM" forum's new home on
Microsoft Q&A!
For more information, please refer to the
sticky post.
Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.