@glyph My understanding is it leaves SIP enabled and installs a management profile to get the OS to remove the model on its own. This appears to be an officially supported configuration from Apple that’s mainly aimed at large organizations with device management.