[...] which prevents configuring separate URLs in the
enrollment profile as described later in this guide.

It's unclear why this is a requirement just because it's mentioned in the guide. The separate URLs are just a byproduct of ngrok generating separate hostnames in the past. For example MicroMDM has used a single URL from the get-go.

Thanks for the clarification — I agree that separate hostnames are not
strictly required. Using a single hostname with path routing (e.g. /scep
and /mdm) works fine when a reverse proxy is present.

However the quickstart currently runs both services directly behind ngrok
without a reverse proxy. With ngrok Free plan behavior, multiple tunnels
may share the same public hostname.

Example ngrok config:

version: 2
authtoken: xxxxxxxxxxxxxxxxxxxxx
tunnels:
  scep:
    proto: http
    addr: 8080
  nanomdm:
    proto: http
    addr: 9000

Example result:

Forwarding https://abcd1234.ngrok-free.dev -> http://localhost:8080
Forwarding https://abcd1234.ngrok-free.dev -> http://localhost:9000

In this case ngrok does not route based on path. Instead it effectively
load-balances requests between the upstream services. As a result,
requests to /scep or /mdm may be forwarded to either port, which
breaks the enrollment flow.

For example:

https://abcd1234.ngrok-free.dev/scep -> 8080 or 9000
https://abcd1234.ngrok-free.dev/mdm  -> 8080 or 9000

This means the workaround using the tunnels stanza may not work as
expected on Free accounts unless an additional reverse proxy (e.g.
nginx) is introduced to perform path-based routing.

My intention with the note was to clarify this behavior and suggest a
reverse proxy workaround so the quickstart works reliably with modern
ngrok setups.