Enroll the device in a domain with FrE on.
Try to switch to devmode - the device is forbidden the switch, and cleaned.
After reboot the device is force into re-enrollment.
Deprovision the device from admin console.
Reboot the device.
After reboot the device detects that is deprovisioned.
esc+refresh+power and ctrl+d + enter to switch to devmode

Result - devmode is still forbidden.