Trying to understand Policy options

If you remove that machine(s) from the scope I would think it would not apply the policy anymore. Or am I not understanding what you are asking?

Correct, the best way to remove a policy from an iPad (or Mac) is to remove it from the Scope. If the iPad is part of a group and you only want to remove the policy from one iPad in a group you can use the Exclude tab and just add the specific iPad you want to exclude. This keeps the policy enabled for other iPads in the group and just removes it from the one excluded iPad.

Yeah, I think what you're looking for is to either remove the Mac from the scope of the policy, assuming it was added in manually. Or add the Mac into the Exclusion tab of the policy scope. Then, even if it's landing into scope based on a Smart Group, it will get excluded from the policy and it won't run on it again.

Or, were you actually asking how to undo what a policy has done, like installing something, or making some change to the Mac? If so, that's a different question and one that doesn't have a singular answer since it will depend on what the policy did to the Mac in the first place.

It was as obvious as it appeared. I created a policy to run a script to block an SSID. It worked great, I also made it available offline and thought that meant that it would not remove itself from the device.

I removed the computer from the scope and I was able to see the policy not being enforced.

Thanks for the info.

Rich