Device taken over by unknown Apple Business Manager/MDM enrollment — how to remove or audit?

There is no such thing as an unauthorized MDM. To install MDM, you either

1. Must purchase the device from Apple or an authorized reseller and have it added to Apple Business/School Manager and have an MDM connected for automated device enrollment
2. Someone must have physical access to your device and must have your passcode/password.
3. Someone must have physical access to your device, your iCloud password (assuming you've set that up), and be in a trusted location (or wait for an hour, again, assuming you set iCloud up), then they have to wipe your device and add it to Apple Business/School Manager manually.

Option 1 cannot be removed by you because you don't own the device.

Option 2 can be removed in Settings > General > VPN & Device Management.

Option 3 can also be removed in Settings > General > VPN & Device Management if it has been less than 30 days since the device was enrolled. You would likely notice if this one was the case as again, at a minimum, it requires the device to be wiped.

These are the only options.

If it is popping up when you wipe and reset the phone, it will tell you the name of the org doing the management.

If you happened to buy the device used, please see: The All Too Common SAD Reality of Buying … - Apple Community

Personal Apple Accounts CANNOT be added to Apple Business/School Manager. ABM/ASM does not support accounts ending in iCloud.com, me.com, gmail.com, aol.com, etc.

I have the same experience. Someone in our IT department used an invoice for a similar company-owned device to take control. They worked with Apple and were somehow able to transfer my personal device (in no way affiliated with the company) to our company Apple account. I have proof of this. They installed Parallels and also use Microsoft policies to further control my devices and accounts. I reported this once to Apple legal, but will try again.

• Provide a screenshot of what you find concerning as long as it does not reveal any personal information.
• Did you purchase this device from a third party or refurbished? Not unusual to find devices for sale on sites such as Facebook Marketplace that had previously been set up for management, and the only way that MDM software can be removed is by the company that installed it on that device.
• There is no such thing as a hidden profile
• Don't try to interpret analytic logs, there is nothing there that is usable to you and not intended for user consumption or understanding.
• Continue with your police investigation and Apple will cooperate with them for any information requested with a subpoena.
• Apple Legal information is available here: Legal - More Resources - Apple
• Perform a Safety Check. It is not unusual for the steps to not be able to be completed when some apps have been deleted that prevents it from gathering the sharing data, but would still be good to check. Just don't be surprised if it fails.

Safety Check for an iPhone with iOS 16 or later - Apple Support

If you believe your Apple account may have been compromised, see this article: If you think your Apple Account has been compromised - Apple Support

Your phone has not been compromised.

If you believe that is true, you need to be speaking to your HR department and a lawyer.