Incorrect parameter when enrolling devices through Autopilot

I have recently have had issues at a customer with a cryptic error message when deploying Intune-devices through Autopilot. The error message occurs after the ESP (enrollment status page) has been triggered. After some time during the Device Setup phase, the machine reboots and then the <irony>really detailed error message </irony> saying Incorrect Parameter is shown after the reboot. You can just press OK to get past this errormessage, then you can login again and continue the enrollment (user portion). However, it is a pretty annoying error, since this interrupts the provisioning until you press OK.

After a long support case together with Microsoft we came to the conclusion that this is caused by the restart that is forced when applying certain device configuration policies.

The error looks like this (in swedish):

It is also shown in the IntuneManagementExtension.log

AAD User check is failed, exception is System.ArgumentException: Incorrect parameter. The provider is not registered on the system

The reason the error appears is because when the restart is being made, the AAD authentication token is lost, therefore the authentication fails (error is displayed) and then we need to reauthenticate again through the logon screen in order for the ESP to continue with the Account setup step.

The policy that caused the restart in my case was a Endpoint protection policy that contained settings for Credential Guard and Bitlocker which was assigned to All devices.

When a policy is assigned to All Devices, it is applied at the ESP, and since these settings require a restart, a restart is triggered.

The workaround until MS fixes these issues is to instead assign the policies that require a restart, to All Users instead of All devices. This causes the policies to apply after the ESP.