AFAIK, this has been possible with Azure AD for a while. I think the service on Apple's end was called something like Apple for Business and you could cut a cer

AFAIK, this has been possible with Azure AD for a while. I think the service on Apple's end was called something like Apple for Business and you could cut a cert from it to link to Intune (an MDM) and get pre-enrolled devices directly from Apple with single sign on. I might also be mis-remembering this, it's been a hot minute since I've dealt with this stuff.