Device joins Workgroup instead of Azure AD when using Windows Bulk Enrollment provisioning package

Question

Device joins Workgroup instead of Azure AD when using Windows Bulk Enrollment provisioning package

Yevhen 85

I created a Windows provisioning package for bulk enrollment, following Microsoft’s documentation:

https://learn.microsoft.com/en-us/intune/intune-service/enrollment/windows-bulk-enroll

Using Windows Configuration Designer (WCD) → Provision desktop devices → Enroll in Azure AD → Get Bulk Token. Authentication is done with my admin account using MFA. The Bulk Enrollment Token is generated successfully, and the package applies without errors.

However, after deployment, the device is not joined to Azure AD — it is only joined to a Workgroup.
A similar issue was discussed here:
https://learn.microsoft.com/en-us/answers/questions/1184368/unable-to-enroll-device-in-azure-ad-using-provisio
where it was mentioned that MFA may cause this behavior.

At the same time, Microsoft has enforced mandatory MFA for all tenants:

https://learn.microsoft.com/en-us/entra/identity/authentication/concept-mandatory-multifactor-authentication?tabs=dotnet and it cannot be disabled.

Question: Given that MFA is now mandatory, how can I create a provisioning package that allows Windows workstations to successfully join Azure AD instead of being joined only to a Workgroup?

VEMULA SRISAI 13,990 Reputation points Microsoft External Staff Moderator

2025-10-16T17:45:44.1633333+00:00

Hello Yevhen,

Thanks for sharing the details. Based on your setup and the behavior you're seeing, it does appear that mandatory MFA may be interfering with the bulk enrollment process, causing devices to remain in a Workgroup instead of joining Microsoft Entra ID.

I’ll review the latest guidance and provide a solution shortly to help you successfully enroll devices using provisioning packages under the current MFA requirements.
Yevhen 85 Reputation points

2025-10-16T18:22:48.2333333+00:00

Thank you
VEMULA SRISAI 13,990 Reputation points Microsoft External Staff Moderator

2025-10-16T19:05:27.9433333+00:00

Hello Yevhen,

Thank you for your patience. After reviewing the latest guidance, I’d like to confirm that MFA cannot be bypassed during bulk enrollment, as the provisioning flow is non-interactive and cannot complete MFA challenges.

Because Microsoft Entra ID enforces MFA for all users, the service account used in the provisioning package (identified by the Package_GUID) must be excluded from MFA using a Conditional Access policy. This is the only supported workaround to allow devices to successfully join Azure AD using a provisioning package.

Here’s what you can do:

Create a Conditional Access policy that excludes the Package_GUID account from MFA.

Assign an Intune license to the Package_GUID account.

Add this account to the Device Enrollment Manager (DEM) role in Intune.

Recreate the provisioning package using Windows Configuration Designer after applying these changes.

Once these steps are completed, bulk enrollment should proceed without MFA blocking the process.

For your reference to create the conditional access policy:

https://learn.microsoft.com/en-us/entra/id-governance/conditional-access-exclusion

Please let me know once you’ve implemented these changes or if you’d like assistance setting up the Conditional Access policy.
Yevhen 85 Reputation points

2025-10-17T08:50:22.89+00:00

Thank you VEMULA SRISAI
I added my user to the excluded list, but the result is still the same

I reviewed the documentation again, and it says that exclusions no longer work.

"If you configured exceptions or exclusions in the policy, they no longer apply"
https://learn.microsoft.com/en-us/entra/identity/authentication/concept-mandatory-multifactor-authentication?tabs=dotnet
Yevhen 85 Reputation points

2025-10-17T09:03:24.75+00:00

https://learn.microsoft.com/en-us/windows/client-management/bulk-enrollment-using-windows-provisioning-tool
Here’s something else I found, it might be related to mandatory MFA
Yevhen 85 Reputation points

2025-10-17T09:07:55.8266667+00:00
VEMULA SRISAI 13,990 Reputation points Microsoft External Staff Moderator

2025-10-22T01:29:25.89+00:00

Hello Yevhen,

Thank you for your follow up, for further assistance, I have asked few details in private message please provide the details.

Your answer

VEMULA SRISAI 13,990 Reputation points Microsoft External Staff Moderator

2025-10-16T17:45:44.1633333+00:00

Hello Yevhen,

Thanks for sharing the details. Based on your setup and the behavior you're seeing, it does appear that mandatory MFA may be interfering with the bulk enrollment process, causing devices to remain in a Workgroup instead of joining Microsoft Entra ID.

I’ll review the latest guidance and provide a solution shortly to help you successfully enroll devices using provisioning packages under the current MFA requirements.
Yevhen 85 Reputation points

2025-10-16T18:22:48.2333333+00:00

Thank you
VEMULA SRISAI 13,990 Reputation points Microsoft External Staff Moderator

2025-10-16T19:05:27.9433333+00:00

Hello Yevhen,

Thank you for your patience. After reviewing the latest guidance, I’d like to confirm that MFA cannot be bypassed during bulk enrollment, as the provisioning flow is non-interactive and cannot complete MFA challenges.

Because Microsoft Entra ID enforces MFA for all users, the service account used in the provisioning package (identified by the Package_GUID) must be excluded from MFA using a Conditional Access policy. This is the only supported workaround to allow devices to successfully join Azure AD using a provisioning package.

Here’s what you can do:

Create a Conditional Access policy that excludes the Package_GUID account from MFA.

Assign an Intune license to the Package_GUID account.

Add this account to the Device Enrollment Manager (DEM) role in Intune.

Recreate the provisioning package using Windows Configuration Designer after applying these changes.

Once these steps are completed, bulk enrollment should proceed without MFA blocking the process.

For your reference to create the conditional access policy:

https://learn.microsoft.com/en-us/entra/id-governance/conditional-access-exclusion

Please let me know once you’ve implemented these changes or if you’d like assistance setting up the Conditional Access policy.
Yevhen 85 Reputation points

2025-10-17T08:50:22.89+00:00

Thank you VEMULA SRISAI
I added my user to the excluded list, but the result is still the same

I reviewed the documentation again, and it says that exclusions no longer work.

"If you configured exceptions or exclusions in the policy, they no longer apply"
https://learn.microsoft.com/en-us/entra/identity/authentication/concept-mandatory-multifactor-authentication?tabs=dotnet
Yevhen 85 Reputation points

2025-10-17T09:03:24.75+00:00

https://learn.microsoft.com/en-us/windows/client-management/bulk-enrollment-using-windows-provisioning-tool
Here’s something else I found, it might be related to mandatory MFA
Yevhen 85 Reputation points

2025-10-17T09:07:55.8266667+00:00
VEMULA SRISAI 13,990 Reputation points Microsoft External Staff Moderator

2025-10-22T01:29:25.89+00:00

Hello Yevhen,

Thank you for your follow up, for further assistance, I have asked few details in private message please provide the details.