SCCM and SCEP Agent License are different .so we have to buy additionally if we like to implement SCEP.
Here we have 2 separate behavior based on OS
For Windows 7 Machines:— You will be able to see as SCEP (System Center Endpoint Protection) as separate agent along with SCCM Client. For installing the SCEP.. You don’t required to push any mechanism.. When you install the SCCM Client, SCEP agent will get auto installed ( Of course assuming you have enabled SCEP) ..For Frequent SCEP client upgrade you have to Deploy with normal patching mechanism or S/W
For Windows 10:—- You won’t be see separate SCEP agent. In windows 10 you can able to see windows Defender (which is comes default with OS). When you install the SCCM Client SCEP will take your Windows Defender with customized policy. For Frequent SCEP client upgrade you have to Deploy with normal patching mechanism or S/W.
As recommends Microsoft, Please create ADR for Definition updates for deploying with Custom policy.