Intune, Entra ID and BitLocker on Computle workstations

This page covers enrolment and device-management issues seen when Microsoft Intune, Entra ID and BitLocker are used with Computle workstations.

---

Irregular MFA or sign-in prompts, or Windows 11 Enterprise uplift fails

What you see

Users on Windows 11 Professional or Enterprise receive repeated Microsoft Authenticator requests. Messages include “Please sign in to your work or school account to verify your information”, “Verify your account” and “We weren’t able to connect. Sign in and we’ll try again”. Devices may also show as non-compliant under Conditional Access policies.

Windows 11 Enterprise uplift

• Cause: Microsoft Authenticator or third-party MFA can interfere with the Primary Refresh Token. When Windows cannot refresh the token, Microsoft removes the Enterprise uplift and can mark the device as non-compliant.
• What to do: Following Microsoft’s subscription activation guidance, remove the MFA requirement from these applications:
  • Universal Store Service APIs and Web Application, AppID 45a330b1-b1ec-4cc1-9161-9f03992aa49f
  • Windows Store for Business, AppID 45a330b1-b1ec-4cc1-9161-9f03992aa49f
  • In our testing, also the Microsoft Intune application, AppID 0000000a-0000-0000-c000-000000000000

MFA for device enrolment

• Cause: Microsoft Authenticator or third-party MFA can interfere with the Primary Refresh Token. When Windows cannot refresh the token, Intune can mark the device as non-compliant, which signs the user out of Microsoft 365 desktop apps. Those apps may then fail to sign in.
• What to do: Exclude Microsoft Authenticator when enrolling devices into Intune and create a dedicated enrolment account. In Entra ID go to Devices > Device settings and untick MFA on enrolment. Create a device enrolment user and configure your enrolment policies to allow only that user.

Update your Conditional Access policies to match.

Third-party MFA

• Cause: Default Conditional Access policies can interfere with third-party MFA.
• What to do: Check the sign-in frequency under Conditional Access > Session > Sign-in frequency.

Credential cache

• Cause: Cached credentials cause an immediate failure when re-authenticating with OneDrive or Microsoft 365 desktop apps.

• What to do: Delete the contents of this folder, then sign in again:

  C:\Users\{username}\AppData\Local\Packages\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy

---

BitLocker enters recovery, or re-arms and locks the workstation

What you see

The Computle workstation asks for a BitLocker recovery key when it restarts.

• Cause: By default Windows locks the BitLocker drive after 4 to 32 failed sign-in attempts, and the failure count only decreases by one every two hours. On a workstation that several people share, ordinary use can reach that threshold. Failed sign-ins from an attacker can also trigger it.
• What to do: one of the following.
  • Restrict access to the workstation to known devices with an allow-list or Zero Trust policy. See our guide to Zero Trust and VDI.
  • Raise the lockout value in Group Policy under Computer Configuration > Administrative Templates > System > Trusted Platform Module Services > Standard User Individual Lockout Threshold.
  • Raise the lockout value in Intune under Device configuration > Administrative Templates > System > Trusted Platform Module Services.
  • Configure BitLocker Network Unlock.

If this does not resolve it, raise a ticket through the Computle Portal.