🛡️🧑💼👈🔓Group - MDM Unenrollment Allowed users
🔒 Why it exists
Most users shouldn’t be able to remove MDM enrollment — that’s why we apply the ⚙️🪟🧑💼CP - MDM Unenrollment Block.
But sometimes:
- A device needs reprovisioning
- You’re staging equipment
- Someone’s in a test lab
That’s when this group comes in.
📊 Configuration overview
| Field | Value |
|---|---|
| Group name | 🛡️🧑💼👈🔓Group - MDM Unenrollment Allowed users |
| Group type | Security |
| Membership type | Assigned |
| Description | Members of this group are allowed to manually remove their device from MDM, overriding the default block policy. |
📋 Governance tips
- Keep membership tight and documented
- Only add users with written approval
- Clean up regularly (before something breaks)
This group grants the power to unmanage. And unmanaged = unprotected.
🔗 Related
- ⚙️🪟🧑💼CP - MDM Unenrollment Block
- ⚙️🪟🧑💼🔓CP - MDM Unenrollment Allow
- 🧠 Blog: Wait... Standard Users Can Do WHAT Now?!
🧠 Final words
This group is like giving someone keys to the Batmobile — cool, but only if they know what they're doing.
Use it wisely. Document everything. And never hand it out just because someone asked nicely over coffee ☕️.