Skip to main content

⚙️🪟🧑‍💼🔓CP - Security - MDM Unenrollment Allow

What this page is about 🔓​

This policy re-enables the ability to manually remove MDM enrollment — but only for people who know what they're doing (or at least pretend to).

It’s the counter-policy to:

Assigned only to users in a strict exception group, this config sets AllowManualMDMUnenrollment = True so they can disconnect from MDM when needed (e.g. staging, testing, lab work).

Need more context? Read the full blog to see why you probably don’t want to hand this out like candy.

📄 Policy details​

FieldValue
PlatformWindows 10/11
Profile typeSettings catalog
CategoryExperience > Allow manual MDM unenrollment
Setting nameAllowManualMDMUnenrollment
StateEnabled
CSPExperience/AllowManualMDMUnenrollment

🕵️‍♂️ When to use this​

You only apply this when:

  • A device needs to be unenrolled for staging or reprovisioning
  • You're working in a test lab
  • You're trying to fix something without nuking the entire environment

And yes, there should always be documentation and approval. Because “I needed to test something” is not a valid excuse when the CFO’s laptop disappears from Intune.

👥 Group Assignments​

✅ Included:​

❌ Excluded:​

  • (None) — this policy is not meant for the masses

🔗 Related​

🧠 Final words​

This setting is your emergency override. Like the Batcave self-destruct — don’t give out the password unless you're sure.

Use sparingly. Monitor carefully. And document like your job depends on it. (Because it probably does.)