A bit of an overkill, but have you tried to restart or restore the
device after removing from the trust scoping? Without user input the VPN
might still be active until at least a restart, possibly restore.
Without more background it seems like a VPP issue. Du you have one VPP
token for the whole school, or multiple? Have any of the Apple accounts
used for VPP been password reset recently? On another note, what does
the audit logs say?
I think @DeniseL Is onto something, Single App mode is not directly
accessible to the end user, but Guided Access Mode is. Single app mode
should need either an MDM command, or Apple Configurator for Mac using
profile import. If they use Configurator...
I have seen devices previously enrolled to other MDMs create havoc for
just this reason during first time setup.I advocate storing as much as
possible to a cloud of some sort. You can turn off the option to restore
from backup in Setup assistant, the...
