This work is started.
Cloud Device Administrator is the new role that will provide this capability . This will be generally available in the coming monthsJohn K commented
+1 for this. GA access is heavily restricted, and it's preventing us from enrolling phones when we hit the limit.