According to Jamf documentation the user bypass code is only collected when a user has activation locked a device.
"Bypass code to use when Activation Lock is enabled by the user—This bypass code is collected if the device supports Activation Lock and the end user has enabled it."
This is not the case. All our devices regardless have a user based bypass code (along with device based) even if the user has not activation locked. This makes it confusing on what code should be used.
I do have an activation lock status search which shows all of the devices as NO (Yes means personal apple ID locked). But not sure I can even trust that.