@Tobias Thanks for posting on our Q&A.
For this issue, if the device is BYOD, it is needed to enroll this device using BYOD enrollment. If we deploy configuration policies (the settings are configured to enabled or disabled) to this device via intune, we can't change the related settings manually on this device. However, if the settings in the configuration policies are configured to not configured, we can change related settings manually.
Hope it will clarify something.
If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.