Only console admins or owners from the customer portal, or the reseller. End-users cannot remove their device from zero-touch enrolment.