The Configure button for Scan Zone Settings in Symantec Endpoint Protection (SEP) 14.0 for Mac remains active:
Despite having a Lock in the Symantec Endpoint Protection Manager (SEPM) policy:
This is because in SEP 14.0 "Scan Zone Settings" (unlike in SEP 12.1) are no longer exclusive to "AutoProtect" and include "Manual Scans" / "Schedule Scans".
Regardless of that product modification, any changes made by end user to "Scan Zone Settings" are only temporary and will be overwritten by SEPM policy.