Plan for Change: Windows bulk enrollment token validity period is changing to 90 days for existing tokens

Previously mentioned in MC1519854, as part of Microsoft’s Secure Future Initiative, Microsoft will soon reduce the maximum validity period for newly issued bulk enrollment tokens used for Windows bulk enrollment through Windows Configuration Designer from 180 days to 90 days.

Starting in mid-January 2027, existing tokens that are older than 90 days will expire.

[Rollout schedule:]

This change will roll out in mid-January 2027 and is expected to be completed by end of January 2027. 

[How this affects your organization:]

Our telemetry indicates that your organization has a bulk enrollment token with more than 90 days for expiration. Any token that is more than 90 days will expire when this change rolls out.

[What to do to prepare:]

If your organization uses bulk enrollment for Windows devices, we recommend reviewing your tokens and re-generate them if they are close or above the 90-day validity period. Update older tokens as they may have expired as part of this rollout. For more information, refer to Bulk enrollment for Windows devices - Create a provisioning package (step 6).