Turning off Windows MDM fails to unenroll existing devices

[mna]

Fleet version:
4.59

Web browser and operating system:
N/A

---

💥  Actual behavior

Turning off Windows MDM should unenroll devices from Fleet's MDM. As part of my test for Windows migration, I noticed that it failed to do so.

🧑‍💻  Steps to reproduce

1. Enable Windows MDM
2. Enroll a Windows device, wait for it to be fully enrolled in MDM
3. Turn off Windows MDM
4. Check if the device is unenrolled, look at the Fleet server logs for errors

You should see logs like this:

level=info ts=2024-11-26T20:54:47.753080855Z component=http path=/api/mdm/microsoft/management err="MDM features aren't turned on in Fleet. For more information about setting up MDM, please visit https://fleetdm.com/docs/using-fleet"

🕯️ More info (optional)

This is likely because the Windows MDM management endpoints are wrapped in a middleware that checks if Windows MDM is enabled, but at the point in time when hosts try to unenroll, Windows MDM has been turned off so the fleet server rejects the request due to MDM not being enabled:

fleet/server/service/handler.go

Lines 929 to 950 in 317b94b

	// These endpoint are used by Microsoft devices during MDM device enrollment phase
	neWindowsMDM := ne.WithCustomMiddleware(mdmConfiguredMiddleware.VerifyWindowsMDM())
	// Microsoft MS-MDE2 Endpoints
	// This endpoint is unauthenticated and is used by Microsoft devices to discover the MDM server endpoints
	neWindowsMDM.POST(microsoft_mdm.MDE2DiscoveryPath, mdmMicrosoftDiscoveryEndpoint, SoapRequestContainer{})
	// This endpoint is unauthenticated and is used by Microsoft devices to retrieve the opaque STS auth token
	neWindowsMDM.GET(microsoft_mdm.MDE2AuthPath, mdmMicrosoftAuthEndpoint, SoapRequestContainer{})
	// This endpoint is authenticated using the BinarySecurityToken header field
	neWindowsMDM.POST(microsoft_mdm.MDE2PolicyPath, mdmMicrosoftPolicyEndpoint, SoapRequestContainer{})
	// This endpoint is authenticated using the BinarySecurityToken header field
	neWindowsMDM.POST(microsoft_mdm.MDE2EnrollPath, mdmMicrosoftEnrollEndpoint, SoapRequestContainer{})
	// This endpoint is unauthenticated for now
	// It should be authenticated through TLS headers once proper implementation is in place
	neWindowsMDM.POST(microsoft_mdm.MDE2ManagementPath, mdmMicrosoftManagementEndpoint, SyncMLReqMsgContainer{})
	// This endpoint is unauthenticated and is used by to retrieve the MDM enrollment Terms of Use
	neWindowsMDM.GET(microsoft_mdm.MDE2TOSPath, mdmMicrosoftTOSEndpoint, MDMWebContainer{})