Bulk Enrollment suddently stopped working?

One more thing worth checking that is specific to bulk tokens. A provisioning package token is tied to a bulk enrollment account that Windows Configuration Designer creates in your tenant (it shows up as a user named package_ followed by a GUID). Whatever state that account is in decides whether the token still works:

• Check that the package_ account still exists and is not blocked. A cleanup script or a lifecycle policy that removes or disables unused accounts will break every package that uses it, and it can look like AADSTS240001 even though the person generating the token is fine.
• Check the token expiry. Bulk tokens only last a limited time (up to 180 days), so a package built months ago can start failing all at once.
• Look at Conditional Access. A new or changed policy that targets the Register or join devices user action, or a block on all cloud apps, will hit the bulk account and the sign-in log will show which policy did it.

If the account is gone, generate a fresh package in WCD and check that Users may join devices is allowed for the person creating it.

Glad to see I'm not alone. A week or three ago we've extensively tested our migration scipts (which deploy a PPKG with Bulk Token) and now, while 500 miles from home, I can't generate a new token. Same error message: AADSTS240001: User is not authorized to register devices in Azure AD

Same error for a completely different tenant which I tried. I raised a ticket with Microsoft, spent the better part of yesterday troubleshooting with 3 or 4 different Microsoft employees, but to no avail. It "just stopped working" and it's frustrating me to no limit. 

Also, I tried reïnstalling a device, fresh Win11 Pro, manually generate a BPRT with AADInternals powershell (which works). Manually deployed the package, device reboots (as it should). Everything from the package is done, like change DeviceName, create LocalAdmin, EXCEPT for Azure AD Join, that keeps saying Deployment Error. When sniffing in the event logs it comes back with the same message about not authorized to join devices to Azure AD.

Tonight I fly home, with 3 days wasted on hotels and a very irritated customer as you can understand. That's no ones problem, but it frustrates me the most that we tested this to the moon and back, migrated 300+ devices during July/August this year on prem, but when I fly out to another country, it stops working :) Bad karma I guess... 

EDIT: I saw in my Entra that a service issue was raised, Microsoft says they have a fix which is being rolled out as we speak. Should be done by 10/21 @ 20:00h UTC. So will test this tomorrow morning first thing!

I have exactly the same problem. However, I only manage one tenant. Until yesterday, there were no problems with the Windows Configuration Designer, but since then it says: "Bulk token retrieval failed. The operation returned an empty response. Please try again." and in the ICD.log "AADSTS240001: User is not authorized to register devices in Azure." Everything I could research didn’t bring a solution. I contacted support with the Correlation ID and Request ID. Been waiting for a response since yesterday noon ...

Seeing this across three tenants makes a shared service or WCD issue worth investigating, but yesterday’s success doesn’t completely rule out an authorization problem today.

One important distinction: Intune enrollment restrictions and Entra device-join permissions are separate controls. Removing the former doesn’t rule out the latter. Check Entra ID > Devices > Device settings > Users may join devices to Microsoft Entra ID for the account requesting the token.

Then check that account’s Entra sign-in logs at the time of the failed attempt, including the Conditional Access results. Also check Microsoft 365 service health for any relevant Intune or Entra advisory.

If those checks show nothing, raise a support case with the timestamps, correlation IDs, WCD version, and examples from all three tenants. AADSTS90202 alone doesn’t confirm an outage, but reproducible failures across tenants are useful evidence. I wouldn’t remove any more restrictions without a specific failure pointing to them.