Persistence via MDM

An adversary can abuse Windows MDM enrollment by inducing a local-administrator user to enroll a device that is not already MDM-managed with an adversary-controlled MDM service. After the user completes the built-in enrollment flow and authenticates, the device establishes a management channel to that service. Published research demonstrates that a malicious MDM server can use supported management functions to deploy an application that runs as SYSTEM, enabling code execution and a UAC bypass. This is user-mediated feature abuse, not a bypass of enrollment authentication; enrollment alone does not prove that a policy or application ran.