A contractor's SaaS grant ends today, but the city phone stays enrolled until Friday. How should the operator stop Hub launch of those SaaS apps now?

When a contractor's SaaS grant ends today but the city phone stays enrolled until Friday, the operator should remove the Access application assignment now; identity assignment is independent of the MDM enrollment record. That immediately stops Hub launch of those SaaS apps without waiting for unenrollment day. Unenrolling the phone immediately because Access assignment is the same as the MDM record conflates identity entitlement with device management lifecycle. Leaving the Access assignment in place assumes enrollment is the only launch control, which leaves SaaS accessible. Wiping the phone with Assist because SaaS rights live only on the device is unnecessary when Access assignment removal revokes launch rights centrally. Exam caveat: coordinate with HR/contract end dates so Access removal is timed to the business offboarding, not only asset return. Operational check: remove the contractor's Access app assignments at end of day, verify Hub no longer shows the SaaS tiles, leave UEM enrollment until Friday per asset schedule, then unenroll/wipe on return. In municipal EUC operations, record the console path and the rejected alternatives in the change ticket so the next on-call technician repeats the same evidence-first workflow for city staff.