Consider a feature like MicroMDM's block functionality that asks a device to un-enroll itself at next checkin. Consider a "block-once" functionality where, after issuing the 401 response, it "unblocks" the device.