Microsoft is forcing everyone onto Azure AD or whatever so that should fix that.

Last time I dealt with Apple MDM was integrating it with on-prem AD and it was a pain. I know it’s better now because last few “gigs” have used it and it’s been pretty seamless with Microsoft Authenticator for Teams. (Ugh!)