⚙️🪟🧑💼CP - Security - MDM Unenrollment Block
What this page is about 🔒
This policy stops users from manually removing their device from MDM — because yes, even standard users can do that by default. And no, it’s not a joke.
This sets AllowManualMDMUnenrollment = False, blocking the “Disconnect” button under Access work or school in Settings.
No more rogue offboarding. No more accidental BYOD situations. No more drama.
If you're not sure why this exists — read this blog post for the full meltdown story.
❗ Why this matters
By default, Windows thinks users should be trusted to manage their own MDM enrollment. That’s adorable.
Without this policy:
- Any standard user can click “Disconnect”
- Compliance? Gone.
- Security baselines? Gone.
- Your grip on reality? Also gone.
It’s like letting Deadpool run your Intune environment — chaotic, loud, and something’s probably on fire.
📄 Policy details
| Field | Value |
|---|---|
| Platform | Windows 10/11 |
| Profile type | Settings catalog |
| Category | Experience > Allow manual MDM unenrollment |
| Setting name | AllowManualMDMUnenrollment |
| State | Disabled |
| CSP | Experience/AllowManualMDMUnenrollment |
👥 Group Assignments
✅ Included:
All Users
❌ Excluded:
Because some users (like staging admins or troubleshooting engineers) need a way out. But we do it cleanly, with the Allow policy, and not by letting Jan from Finance click buttons he doesn't understand.
🔗 Related
- ⚙️🪟🧑💼🔓CP - Security - MDM Unenrollment Allow
- 🛡️🧑💼👈🔓Group - MDM Unenrollment Allowed users
- 🧠 Blog: Wait... Standard Users Can Do WHAT Now?!
🧠 Final words
This setting is like the ejector seat in a spaceship. Handy if you're an astronaut. Dangerous if you're the intern.
Block it. Document exceptions. And sleep better knowing your endpoints won’t self-destruct mid-flight.