Pushing apps to iOS devices - Is Apple ID required?

We use Intune as our MDM, because we are predominantly Windows (>95%). I want to avoid employees using personal Apple Ids on corporate-owned devices. I thought that the solution was managed Apple IDs. I have a device in Intune and apps scoped to it (they are free apps, but I have purchased licenses for them in Apple Business Manager which Apple states is required). When the iPad receives the request, it asks to sign in with an Apple ID. If I sign in with a managed Apple ID, I get the error that I can not purchase apps with this account.

Do I have something not configured properly, or is the only option to sign in with an Apple ID that is not managed?