APM Machine Tunnel - Machine Cert Auth Check Failing

I have an APM policy configured, with the initial check being 'client type' for a machine tunnel or edge client. After that there is a Machine cert auth check for both edge client and machine tunnel ...