How to remove MDM configuration profile from iOS device after device is released from MDM

I manage the iOS devices deployed to our organisation. Devices are generally enrolled in MDM by the vendor and given initial configuration through Configurator 2 which also performs auto enrollment and activation.

Profile manager is listed in Apple Business Manager as an authorised server and the option to "Allow this MDM Server to release devices for any new or existing MDM servers you created" is checked.

When a user leaves the organisation, the device needs to be released from MDM and this is normally accomplished by removing the device from Profile Manager on the Mac which, in theory, should also release the Device from Apple Business Manager and the organisation. However the MDM profile remains on the released device and seems to require an administration password to remove it entirely.

As some of our released devices are in the field, we do not wish to issue administrator passwords for the sole purpose of removing a stale MDM profile. Therefore I would appreciate any advice as to how permanent removal might otherwise be accomplished without returning the device to base.