⚙️🪟🧑💼🔓CP - MDM Unenrollment Allow
📄 Policy details
| Field | Value |
|---|---|
| Platform | Windows 10/11 |
| Profile type | Settings catalog |
| Category | Experience > Allow manual MDM unenrollment |
| Setting name | AllowManualMDMUnenrollment |
| State | Enabled |
| CSP | Experience/AllowManualMDMUnenrollment |
🕵️♂️ When to use this
You only apply this when:
- A device needs to be unenrolled for staging or reprovisioning
- You're working in a test lab
- You're trying to fix something without nuking the entire environment
And yes, there should always be documentation and approval. Because “I needed to test something” is not a valid excuse when the CFO’s laptop disappears from Intune.
👥 Group Assignments
✅ Included:
❌ Excluded:
- (None) — this policy is not meant for the masses
🔗 Related
- ⚙️🪟🧑💼CP - MDM Unenrollment Block
- 🛡️🧑💼👈🔓Group - MDM Unenrollment Allowed users
- 🧠 Blog: Wait... Standard Users Can Do WHAT Now?!
🧠 Final words
This setting is your emergency override. Like the Batcave self-destruct — don’t give out the password unless you're sure.
Use sparingly. Monitor carefully. And document like your job depends on it. (Because it probably does.)