High severityauthentication
Power BI Error:
AADSTS90114
What does this error mean?
The bulk token request specifies an expiration timestamp that would result in an already-expired token.
Common causes
- 1Bulk token expiration timestamp is set in the past (e.g. clock skew or stale provisioning package)
- 2Requested expiration exceeds the tenant's maximum allowed bulk token lifetime (default 180 days)
- 3Bulk enrollment package (PPKG) was generated long ago and the embedded expiration has elapsed
- 4Incorrect time zone / UTC conversion when programmatically setting ValidityPeriod via the Bulk Token API
- 5System clock on the requesting machine is significantly out of sync with Microsoft Entra ID
How to fix it
- 1Generate a fresh bulk enrollment token via Windows Configuration Designer or the Set-AzureADUserExtension/Bulk Token API and set the expiration to a future UTC date within tenant limits
- 2Verify the requesting machine's system clock is correct and synchronized with an NTP source (significant skew triggers this error)
- 3Check the tenant's maximum bulk token lifetime in the Microsoft Entra admin center under Devices → Device settings and keep the requested expiration ≤ that value (max 180 days)
- 4If using a provisioning package (PPKG), re-create it — bulk tokens cannot be renewed and an expired one must be replaced
- 5Confirm the account creating the bulk token still has the Cloud Device Administrator or equivalent role required to issue bulk tokens