I had deployed several servers with the Security Extension direct from the portal.
But when I needed to exclude something I got this error.
I found a solution here and it worked.
1: Open a CMD as admin.
2: Navigate to “program files/microsoft security client”, and then run “configsecuritypolicy cleanuppolicy.xml” (if you use TAB you will stop at the .exe file)
3: Open System Center Endpoint Protection and make your exclusions.
That’s how i got Endpoint protection working on my Azure VM´s, if you have a centrally managed SCEP you might need to push policys again.