Bypass codes are stored in MDM for organization-linked Activation Lock. The Apple Platform Deployment Guide states, "Bypass codes for organization-linked Activation Lock are stored in the MDM solution, allowing administrators to unlock devices without user credentials." Reference:
Apple Platform Deployment Guide, "Activation Lock" section.
Mobile Device Management Protocol Reference, "Activation Lock Management" section.