I'm sure his MDM-enforced gatekeeper setting is on "Apps downloaded from the App Store" and not in the default position that includes "and identified developers

I'm sure his MDM-enforced gatekeeper setting is on "Apps downloaded from the App Store" and not in the default position that includes "and identified developers". https://support.apple.com/guide/mdm/security-privacy-payload-settings-mdm61dc030/1/web/1.0#:~:text=Configure%20Gatekeeper%20settings https://support.apple.com/guide/mdm/security-privacy-payload...