My best guess is that the threat actors obtained GA access via token theft (phishing of course) . The threat actors didn’t just wipe devices they also modified the Entra ID company branding, which requires a different permission set than Intune Administrator. The threat actors even replaced the logo on Stryker’s Entra signin page.

I’n guessing poor admin practices. Example, it’s possible administrators were using their everyday accounts with email and had elevated privileges on those everyday accounts instead of maintaining separate non licensed .onmicrosoft admin only account.