I can't seem to find a setting for this but I would imagine there would be one.  We have a general portal our customers have logins for to manage their devices for mostly remote control capabilities.  These users should have not have access to un-enroll a device from MobiControl.  That would give them wide-open access to the tablet with our SIM card in it. 

Am I missing the setting to prevent non-admin users from performing this action?

Thanks