How to prohibit students from changing system settings

The poop part of iOS management is Apple forces JAMF to let the users "un-enroll" themselves thus, making iOS management very difficult.

oh ok. Thank you for the response. Do I just turn on the Mobile device enrollment option to notifiy JSS when profile is removed? So any changes to the System settings will be a change to the configuration thus notifying JSS? Also, by notifiying JSS dose it mean it will notify anyone configured to be notified? Thank you.

I'm preconfiguring 150 iPads. So I'm trying to build the enrollment profile in JSS, downloading it, and importing into Apple Configurator. That all seems to work, but what I want to do is edit the profile in AC to restrict removal only with authorization. When I do that and apply, the result is "Can't install profile" in AC.

Is this possible? And if not, is there a way to be notified if a user "un-enrolls". It seems there is a checkbox in JSS enrollment creator to "notify JSS when profile is removed" but this doesn't seem to work. I get notified when a device is enrolled but not unenrolled.

thanks for any insights,