Always on VPN - Forced Tunnelling / Lockdown Mode

Hi,

I'm struggling to create a VPN connection with these settings, I'm using the MS provided PowerShell and sample XML script from this article:

https://docs.microsoft.com/en-us/windows-server/remote/remote-access/vpn/vpn-device-tunnel-config

This sample works just fine if I use a split tunnel and I've been testing it for a while but I'd like to test it with Forced Tunnelling or LockDown mode now, adding <LockDown>true</LockDown> to the XML doesn't seem to make a difference, nor changing<RoutingPolicyType>ForceTunnel</RoutingPolicyType> 

Am I right in thinking that this article is suggesting that LockDown should be added after the "Always On" and before the "Device Tunnel" parameters

https://docs.microsoft.com/en-us/windows/client-management/mdm/vpnv2-csp

Does anyone know the correct syntax here?

PS we're using device tunnels not user tunnels