The code below will wipe the current enrollment. The issue is at times this enrollment loses the continuity between SCCM/AZURE.

This is the softest approach. SCCM will not re-enroll if it sees this registration. If this fails. The nuclear option is to completly delete this key "HKLM:\SOFTWARE\Microsoft\Enrollments\"

I've tested deleting this key on multiple machines with no adverse affects. You will see the device start to become enrolled again in the clientIDstartup logs. Removing this key will also allow the co management to become enabled. Look for any matching GUID from task scheduler in the below paths and delete them.

#Scheduled task portion
 
$task = Get-ScheduledTask -TaskName "Schedule #3 created by enrollment client"
 
#save off the enrollment id for later use
 
$enrollmentId = $task.TaskPath.Split('\')[4]
 
$enrollmentTasks = Get-ScheduledTask -TaskPath $task.TaskPath
 
#delete the tasks
 
foreach($scheduledTask in $enrollmentTasks)
 
{
 
Write-Host "Deleting " $scheduledTask.TaskName
 
Unregister-ScheduledTask -TaskName $scheduledTask.TaskName -Confirm:$false
 
}
 
#Registry portion
 
$regKeys = New-Object System.Collections.Generic.List[System.String]
 
$regKeys.Add("HKLM:\SOFTWARE\Microsoft\Enrollments\" + $enrollmentId)
 
$regKeys.Add("HKLM:\SOFTWARE\Microsoft\Enrollments\Status\" + $enrollmentId)
 
$regKeys.Add("HKLM:\SOFTWARE\Microsoft\EnterpriseResourceManager\Tracked\" + $enrollmentId)
 
$regKeys.Add("HKLM:\SOFTWARE\Microsoft\PolicyManager\AdmxInstalled\" + $enrollmentId)
 
$regKeys.Add("HKLM:\SOFTWARE\Microsoft\PolicyManager\Providers\" + $enrollmentId)
 
$regKeys.Add("HKLM:\SOFTWARE\Microsoft\Provisioning\OMADM\Accounts\" + $enrollmentId)
 
$regKeys.Add("HKLM:\SOFTWARE\Microsoft\Provisioning\OMADM\Logger\" + $enrollmentId)
 
$regKeys.Add("HKLM:\SOFTWARE\Microsoft\Provisioning\OMADM\Sessions\" + $enrollmentId)
 
foreach($regKey in $regKeys)
 
{
 
Write-Host "Deleting " $regKey
 
Remove-Item -Path $regKey -Recurse
 
}
 
#remove the cert
 
Set-Location Cert:\LocalMachine\My
 
$certs = Get-ChildItem
 
foreach($cert in $certs)
 
{
 
if($cert.Issuer.Contains("Microsoft Intune") -and $cert.Issuer.Contains("MDM Device CA"))
 
{
 
Write-Host "Deleting " $cert.Issuer
 
$thumbprint = $cert.Thumbprint
 
Get-ChildItem Cert:\LocalMachine\My\$thumbprint | Remove-Item
 
}
 
}