Second one. It’s also not secret - you are greeted with a prompt, which you must accept, to complete enrolment (although granted you can’t use the device withou

Second one. It’s also not secret - you are greeted with a prompt, which you must accept, to complete enrolment (although granted you can’t use the device without accepting). Essentially, the device phones home during setup, and asks Apple whether it’s in Apple Business/School Manager. If it is, and it’s assigned to an MDM, Apple will let it know the host name of that server to try and prompt the user to enroll into.