Scope DEP enrollment to specific groups/users

Hi,

I am struggling trying to limit DEP enrollment to only real users in Active Directory. We have a couple generic accounts that are able to enroll through DEP. I have added them to the users/groups in the jss without privileges to enroll, yet they can still enroll.

Thanks,

Brad