Any modern MDM like Jamf, Kandji, Mosyle, etc. + the identity/IAM of your choice (most commonly Entra or Okta)

Since SIP, it's MDM with DDM and you can basically leave engineers be local admins as it has no impact on the system state anymore.

JAMF is popular. I've heard of Kandji too.