Yes, this is basically what I had to do as well. Two profiles,
opposites. I remove the user from one scope then add them to the other
to allow us to turn off FMM for repair.
Did you figure out a way around this? I ran the config profile to
disable FMM but it just disabled the option. Users that had FMM on still
have it on and now we cannot turn it off.
