Required: osquery deployed with Orbit, or manual installation of macadmins/osquery-extension. Checks that a mac is enrolled to MDM. Add a AND on identity_certificate_uuid to check for a specific MDM.
Use the policy below to verify
SELECT 1 from mdm WHERE enrolled='true';