Forum Discussion
Bulk Enrollment suddently stopped working?
We've been generating BPRT tokens for Entra ID enrollment via provisioning package (WCD) for a long time. This started out of the blue, tried from three different tenants, these two error messag...
One more thing worth checking that is specific to bulk tokens. A provisioning package token is tied to a bulk enrollment account that Windows Configuration Designer creates in your tenant (it shows up as a user named package_ followed by a GUID). Whatever state that account is in decides whether the token still works:
- Check that the package_ account still exists and is not blocked. A cleanup script or a lifecycle policy that removes or disables unused accounts will break every package that uses it, and it can look like AADSTS240001 even though the person generating the token is fine.
- Check the token expiry. Bulk tokens only last a limited time (up to 180 days), so a package built months ago can start failing all at once.
- Look at Conditional Access. A new or changed policy that targets the Register or join devices user action, or a block on all cloud apps, will hit the bulk account and the sign-in log will show which policy did it.
If the account is gone, generate a fresh package in WCD and check that Users may join devices is allowed for the person creating it.