Bulk Enrollment suddently stopped working?

Seeing this across three tenants makes a shared service or WCD issue worth investigating, but yesterday’s success doesn’t completely rule out an authorization problem today.

One important distinction: Intune enrollment restrictions and Entra device-join permissions are separate controls. Removing the former doesn’t rule out the latter. Check Entra ID > Devices > Device settings > Users may join devices to Microsoft Entra ID for the account requesting the token.

Then check that account’s Entra sign-in logs at the time of the failed attempt, including the Conditional Access results. Also check Microsoft 365 service health for any relevant Intune or Entra advisory.

If those checks show nothing, raise a support case with the timestamps, correlation IDs, WCD version, and examples from all three tenants. AADSTS90202 alone doesn’t confirm an outage, but reproducible failures across tenants are useful evidence. I wouldn’t remove any more restrictions without a specific failure pointing to them.