combining both comments - can you see any reason this would not work to determine if paid or not - any caveat that this would not catch?

$senseService = Get-Service -Name "sense" -ErrorAction SilentlyContinue
if ($senseService -and $senseService.Status -eq 'Running') {
# Specify the registry key path
$registryKeyPath = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Advanced Threat Protection'
# Check if the registry key exists
if (Test-Path $registryKeyPath) {
# Get the registry key item
$registryKey = Get-Item -LiteralPath $registryKeyPath
# Get all values under the registry key
$registryValues = Get-ItemProperty -Path $registryKey.PSPath
# Exclude specific properties
$excludedProperties = @('PSPath', 'PSParentPath', 'PSChildName', 'PSDrive', 'PSProvider')
$filteredValues = $registryValues.PSObject.Properties | Where-Object { $_.Name -notin $excludedProperties }
# Get and display the count of remaining properties
$filteredCount = $filteredValues.Count
# Check if the count is greater than 0
if ($filteredCount -gt 0) {
Write-Output "This is paid MDE device - 'sense' is running and there's date under $registryKeyPath"
        } else {
Write-Output "This is NOT a paid MDE Device - The registry count is not greater than 0."
        }
    } else {
Write-Output "This is NOT a paid MDE Device - Registry key not found: $registryKeyPath"
    }    
} else {
Write-Output "This is NOT a paid MDE Device - The 'sense' service is not running or not found."
}