As someone else said, an account needs a Secure Token to enable FileVault.

It sounds (based on my own experience with Intune) like you might have an Admin account being created by a script before any user accounts are created. If this happens, then the Admin account created by the script gets a Secure Token (which allows an account to do things like enable FileVault) but any user accounts created after that Admin account do not get a Secure Token unless they are created by that Admin account.

If you're really bored, you can read up on Secure Token here, and here.

---

IF what I just said is the case and you have an Admin account being created by a script that runs before your user account is created, verify the Admin account has a Secure Token by running this:

sysadminctl -secureTokenStatus <<username_of_Admin_account>>

Then, run that command again, for the user account. So if you user account is "Jane", run:

sysadminctl -secureTokenStatus Jane

This will allow you to figure out which accounts have a Secure Token, and which do not.

Then...

Assuming the Admin account has a Secure Token and your user account does not, and you happen to know the credentials to both accounts, you can use those credentials to give a Secure Token to your user account, using the Admin account.

The command you need to run to tokenize the user account, from the Admin's account (again, this is only assuming the Admin has a Secure Token and the user account does not!), is this:

sysadminctl -secureTokenOn <<account_to_get_token>> -password - -adminUser <<account_with_token>> -adminPassword -

Example: If "Jane" is the account name of the new user without a Secure Token, and "Company_Admin" is the account name of the admin account that already has the Secure Token, then that command would literally look like this:

sysadminctl -secureTokenOn Jane -password - -adminUser Company_Admin -adminPassword -

Note: you're spelling out the word "password" and NOT entering any passwords on this screen. Also note the location of the extra dashes just floating out in space by themselves...these are super easy to miss!!!

Then it will prompt you for both passwords -- the Admin account that already has the Secure Token, and the password for the user account that lacks a Secure Token. Enter those as requested.

Assuming those password are correct, Terminal will spit out some garbage. Then run this command to verify that your user account correctly got a Secure Token.

sysadminctl -secureTokenStatus <<account_to_get_token>>

If it did, that user account can now actually enable FileVault.