Well, it's not that simple, but you can do a lot with MS apps/Data using this tool.  We've also scripted removal of data which we use as well.

Office Reset Tool 

Yuck. Not a good position to be in. If you are doing things apples way you can separate corporate and personal data. This requires the use of a Managed AppleID if I am not mistaken. We do not allow BYOD with Mac for obvious reasons so I have never had to deep dive these functions. If you are bringing in personal devices and treating them like enterprise owned devices there is no way to make sure all cooperate data has been removed. Users can save emails, and take screenshots and save anything anywhere they want. Tell your employer to stop being cheap and provide corporate own Macs lol, problem solved.

Managed Devices and Corporate Data (apple.com)

Thanks for the suggestions @AJPinto and @scottb .  I think what I'm going to do is configure some sort of notice when a user enrolls that says something like, if you enrol your personal Mac, be aware that your device may be subject to a wipe if deemed necessary.  I did a bit more research on this.  From a Microsoft perspective I believe Azure Information Protection (AIP) is what modern enterprises would use.  For the MacOS platform however, I believe AIP does not exist yet.  RMS (Rights Management Service) does and this can be used to honour AIP tags, but you cannot classify documents (apply data tags) from what I have read. 

Its more of a philosophy thing. Apple views user data, security and privacy are paramount. Apple strongly believes the users are in control of their devices. You cannot Manage an Apple product with Microsoft tools or manage MacOS with a Windows Mentality. 

Yes, Microsoft uses Azure Information Protection. It is a Microsoft platform after all. MacOS is not a Microsoft platform and will likely never support AIP though submitting a feedback request would not be a bad idea. Maybe using Office online and disabling downloads would be a better solution, make people edit their docs in an Azure controlled space.

Apple does things in their own way. Apple handles data segregation between personal and enterprise data with managed apple ID's. This is no different than how Microsoft is doing it with AAD. You tie all your cooperate data to the managed appleID, they user uses Apple Mail, Pages, ext. When you terminate their access everything corp owned from Mail, pages, ext vanishes from the device. Maybe the best option is looking for a different solution?

Hi,

do you know if documents created with managed appleID Apps can be deleted as well? Thanks!