Plan for Change: Windows bulk enrollment token validity period is changing to 90 days

As part of Microsoft’s Secure Future Initiative, Microsoft is reducing the maximum validity period for newly issued bulk enrollment tokens used for Windows bulk enrollment through Windows Configuration Designer from 180 days to 90 days. This change strengthens security by reducing the period these tokens remain valid. Tokens issued before the change will retain their original expiration dates.

[Rollout schedule:]

This change will start to roll out in mid-November 2026 and is expected to be completed by the end of December 2026.

[How this affects your organization:]

Our telemetry indicates that your organization has a bulk enrollment token with more than 90 days for expiration. Existing tokens issued before the change will retain their original expiration dates.

After this change, newly issued bulk enrollment tokens will have a maximum validity period of 90 days.

[What to do to prepare:]

If your organization uses bulk enrollment for Windows devices, review your provisioning workflows and plan to use newly issued bulk enrollment tokens within their 90-day validity period. No action is required for existing tokens; existing tokens will retain their original expiration dates.

For more information, refer to Bulk enrollment for Windows devices.