In rare circumstances your tenant may be missing important components to enable the creation of the Bulk Enrolment Token when configuring your Directories.

The errors can be:

“Bulk Token Retrieval Failed”

"AADSTS90092: Non-retryable error has occurred"

To fix this, you may need to create a Service Principal called Microsoft.Azure.SyncFabric.

Check to see if it exists:-

Get-AzureADServicePrincipal | Where-Object {$_.AppId -eq "00000014-0000-0000-c000-000000000000"}

Use this cmdlet to create it:

New-AzureADServicePrincipal -AccountEnabled $true -AppId 00000014-0000-0000-c000-000000000000 -AppRoleAssignmentRequired $False -DisplayName Microsoft.Azure.SyncFabric -Tags {WindowsAzureActiveDirectoryIntegratedApp}

In some rare circumstances you may need to delete and re-create the service principal, so try that too.