Is there a way to prevent a user from unenrolling from the MDM profile?

We are a relatively small company and have been trying to move all our devices into ABM so that we have more control over the device. We have been making an admin account, then making the user account, then downloading the MDM profile from ABM. The issue we are having is that then the user needs the admin password for every little thing, even changing the sleep timer in settings, or downloading apps from the internet (this one I understand more than the settings)

If we add the device with Apple Configurator, the user can simply unenroll from the MDM profile.

I read on a post from 3 years ago that this is only possible for the first 30 days, and after that it can only be removed from ABM, is this still the case? We can’t test it because all previous devices have been added via the first method I mentioned.

We are about to upgrade devices and will be doing this 40+ times, so we want to make sure we do this in a way that doesn’t cause headaches for our employees but also secures the device.

Any help would be appreciated!