Have you wondered why iOS device enrolled via DEP using Apple Configurator shows the option to leave device management:
even if you have not allowed that in your DEP Enrollment Profile settings. Same device shows also a message "This device is managed remotely. You can leave remote management in Settings." on lock screen:
Reason for this is the grace period of DEP enrollment when done with Apple Configurator. So when a device previously not part of the company devices is added under company DEP account, it allows user to cancel this operation during this 30 day grace period. After this time has passed, both the lock screen message and the "Leave Remote Management" option will disappear from the device.
For more information on the DEP enrollment using Apple Configurator and the grace period, please see: https://onlinesupport.miradore.com/hc/en-us/articles/115005486649-Adding-iOS-11-devices-to-Apple-DEP-with-Apple-Configurator-2-5