Event banner
Event details
You might be interested in an Autopilot Reset.
However, I find most people do not understand the nuanced difference between each of the various reset/wipe options. Also, a full reset cures many ills. So, I require my team to always perform a full protected wipe (checking the "wipe until clean" box), as soon as it is known that a device will no longer be in service, or its role / user will change. With only wiped devices on the shelf, they are at the ready for their next life.
In order for this workflow to succeed, everything must be managed (or eliminated) and synchronized (OneDrive, Enterprise State Roaming, Edge sync, etc). Such that a new user can follow the prompts, then use the Company Portal, to get their PC into a working state.
Sorry, I misread your question. Hung is correct, once a device is enrolled, anyone can log in.
You might also be interested in Self-Deploying enrollment profiles and Shared PC policy. Though, using this model you will want to use device licensing for Office and Windows Enterprise, then assign any exceptions to your base configuration using device groups.
https://docs.microsoft.com/en-us/mem/autopilot/self-deploying