How to prevent users from revoking management?

Description

MDM must be present in the enrolled devices to be managed at all times. If a user tries to remove MDM, then the device is unmanaged and the error User has revoked management is displayed against the device, under Remarks in the Enrollment tab. To prevent the user from removing MDM, configure MDM as follows:

Steps 

Corporate Devices

The devices that are owned by the organization and provided to the employees must be managed at all times. The users must not have the permission to remove these devices from management. To prevent users from removing these devices management, these devices can be enrolled using the available corporate enrollment methods. These enrollment methods ensures that the devices cannot be removed from management even if they are factory reset.

iOS devices

1. Device Enrollment Program

Android Devices

1. Zero Touch Enrollment
2. KNOX Mobile Enrollment

Personal Devices

Since these devices are personally owned, we cannot completely restrict the users from revoking management, but we can ensure that the admin is notified when any device is removed from management. Follow the steps given below to enable these notifications

1. On the console, navigate to Enrollment -> Enrollment settings
2. Enable the optionNotify when device becomes unmanaged
3. Enter the email address that must receive the notifications
4. Save the settings

In addition to individual notification, the admin can also view the devices that have not come into contact with the server for a period of time by navigating to Reports ->Inactive devices.

It is also recommended to configure services and distribute enterprise apps only through MDM. Though MDM can be removed, it also results in the configurations and enterprise apps being removed from the managed devices. Thereby ensuring that the user's cannot access the corporate data once the management is revoked from these devices.