What I have been successfully doing is disabling SIP and then running
the command 'Sudo rm -rf ~/Library/Application Support/com.apple.TCC'
from the terminal and then enable SIP again. That seems to do the trick.
I run this out of Self Service, scoped to DEP enrollment complete:
osascript -e 'tell application "System Events" to set visible of process
"Self Service" to false' UN=$(/usr/bin/osascript <<-'EOF'tell
application "System Events" activate set input t...
