offload or remove the knox enrollment

Can't - it's deep in the bootloader and has been since the early Note and Galaxy S series :-(. These phones also killed the unlockable bootloader for unlocked QCA models due to the carriers crying about it, and on OneUI 8 for both grey and domestic models. The issue now is the only models left with it are grey market Exynos models that retain the feature and those are now a problem in the US because the global 5G rollout varies wildly so you need to find the right EU/UK variants of the phone to get the right band for your home country (or make sure the crucial ones like n4 and others in the US are there) with grey market models now.

The only phones we can really import are the iPhones as they are all basically the same band wise, but you still need to buy the right model - for the US for example with the 17, you want the EU variant as the bands match - but some carriers refuse to do it without a throwaway IMEI# to get the pSIM. Many will not issue a eSIM for these if they have the slightest bit of trouble because that means they have to use their brains and do more then a baseline activation or they use it as an excuse to refuse service without a disposable IMEI#.

Only way is to have the MDM owner release it.