Yes its comes from MfE provisioning, there is a way to apply hack with aegis exploits to make provisioning void and even disable device lock while using mfe, but most likely that hack would be against your company policy.