We passed our SOC2 Type 2 audit without any MDM - we're just doing a manual quarterly audit on machines to check that they're update to date.

MDM helps to detect issues earlier, and can remove the need for manual audits, but is not a hard requirement - same with most other things in SOC2.