Why the need to remove the enrollment option "Run Company Portal in Single App Mode until authentication"? Why not leaving in as an option?
We use it today and have done so for years, and it works. And it works for DEM-accounts.
The modern authentication option is really screwing thing up for us because the modern authentication does not support DEM-accounts, as stated by several people in this thread. You get a "There isn't a device setup for this account yet" error.
Many devices are not personal, hence we use DEM-accounts, but we still want to take advantage of the functionality that ADE brings.
The only other option is to use authentication with CP but then no settings are puched to the device until you do that and nothing forces you to do it and you have to complete that step within 24 hours or the enrollment can fail.
The best thing with Run Company Portal in Single App Mode until authentication is that the user is forced to complete the enrollment before thay can use the device. The new modern authentication method also takes care of that on personal devices since the device is fully enrolled during setup assistant and settings is pushed to the user/device directly after the setup assistant. But completion of the enrollment process in CP does not work for DEM accounts and we enroll thousands of devices with those accounts...