We have a fleet of several thousand macOS devices.  We would like to create unique local user accounts on each machine and have those accounts be MDM-enabled.  (This is a requirement for deploying Mac App Store Apps and to used Apple Classroom.)  In the past we have used PreStage enrollment with a script that creates the user account, but that account is not MDM-enabled.

Does anyone have a workflow that can accomplish this?