How does MDM Managed Device validation work?

Device validation

SphereShield for SfB matches device by unique device ID.
When using the app – the application sends UDID/IMEI to the Bastion and the Bastion
authenticates it with the Admin Portal/DB.
When using Wi-Fi (certificate) – Only managed devices can register and SphereShield for SfB
matches devices with MDM based on parameters such as user, device type, OS version, etc.
In the rare case in which SphereShield for SfB can't do an exact match (for example user has
duplicate/multiple identical devices managed in the MDM) SphereShield for SfB will block all of
the devices of this type if the MDM reports on one device that it is OOC (because
SphereShield cannot tell which device exactly is OOC)