Skip to main content

Wait... Standard Users Can Do *WHAT* Now?!

· 3 min read
Fabio van der Burg
Fabio van der Burg
Technical Consultant, Nerd

It started with a ticket:

"Hi IT, I wiped my device because Teams stopped syncing. Can you fix it?"

Weird.
So you check — and sure enough, the device is gone from Intune. Just... gone.
No wipe, no retirement event, nothing in logs. It just vanished like a magician's assistant. 🎩✨

Turns out, the user simply went to:
Settings → Accounts → Access work or school → Disconnect

That's it. Two clicks. No password prompt. No MFA.
And poof — device is unmanaged.

🤯 Wait. What. WHY is that allowed?​

Excellent question. Let me introduce you to the most ignored setting in Windows MDM history:

👉 AllowManualMDMUnenrollment

By default?
Yep: True

What that means:

  • Yes, your 50-person sales team can just leave Intune when Outlook stops syncing
  • Yes, your secure baselines just got nuked by Jan from Finance
  • And yes, this is a default behavior from Microsoft 😐

🧪 Real-world use case: the accidental rogue agent​

Picture this:

  • You configure a laptop with Autopilot and Intune
  • You hand it to a user with standard rights
  • They can’t get something to work
  • They Google it
  • StackOverflow says: “Just disconnect work account and rejoin”

💥 Boom.
Now it’s a BYOD device.
No compliance.
No protection.
No logs.

And let’s be honest...
BYOD doesn't just mean Bring Your Own Device — it also means Bring Your Own Drama™. 🎭📉

🛠️ The Fix​

Step 1: Nuke it from orbit (aka block unenrollment)​

Start with this:

It sets AllowManualMDMUnenrollment = False
Which means: no one leaves — unless you say so.

Step 2: Build an escape hatch (for the chosen ones)​

Create a group for rare exceptions:

And apply this to that group:

Now you can:

  • Give access only to staging engineers
  • Create documented override workflows
  • Avoid accidental compliance disasters

🎬 Final Thoughts​

This setting is the MDM equivalent of leaving the backdoor open during a zombie outbreak 🧟‍♂️.
It seems harmless... until the horde arrives.

Think of AllowManualMDMUnenrollment = True like:

  • Doctor Strange handing out portal rings to every intern 🌀
  • R2-D2 with admin rights
  • Letting Deadpool manage your Intune policies (you’d get chaos, swearing, and somehow still a unicorn)

Default Windows config?
“Mr. Stark, I don't feel so good...” 😵

So:

  • Lock it down like the Stark Vault
  • Use the Allow policy like a Jedi mind trick
  • And remember: just because it’s technically allowed... doesn’t mean it’s wise

Stay safe out there, IT heroes. 🦸‍♂️🖖

Cheers 🍻