Symptom

Device Entra Cutovers have been working fine. The device cutover tsaks still complete successfully but Devices start to fail enrollment and are stuck at a login screen. (Had to Rebuild Via AutoPilot). 

Issue

Upon Investigation the Package_Guid.@domain.com was failing Interactive signins with error:

Sign-in error code
700082
Failure reason
The refresh token has expired due to inactivity. The token was issued on {issueDate} and was inactive for {time}.
Additional Details
Expected part of the token lifecycle - the user went an extended period of time without using the application, so the token was expired when the app attempted to refresh it.

Cause

The Bulk Enrollment Token had Expired. The Token is limited to 180 Days !. As per https://learn.microsoft.com/en-us/intune/device-enrollment/windows/create-bulk-package

Resolution

Re-Create the Windows Enrollment .PPKG (Ensuring it is the same name as configured in QMAD. Then re-deploy to the appropriate repository. We were deploying via Intune so had to create a new Package with a new detection file to overwrite the local .PPKG Files.

Service Improvement Request

This could have been a catastrophic problem if we did not pick this up quickly, It would be ideal if the Quest Pre-Flight checks would check the Bulk Enrollment Token !