You can install Team Foundation Server using one of two deployment models: single-server (application and data tier on the same computer) or dual-server (application and data tier on separate computers). In a single-server deployment, you have the option of installing Team Foundation Server using domain accounts or local workgroup accounts; however, in a dual-server, you must always use domain accounts.

If you choose to install Team Foundation Server using workgroup accounts, you are limited to adding workgroup accounts as users when using Team Foundation Server. That is to say, you cannot add domain user accounts to Team Foundation Server that is using workgroup user accounts to run its services. The reason is fundamental; a service that is using a local workgroup user account logon cannot access a domain controller to authenticate a domain user account.

I'll make this more clear in the next release of the Team Foundation Installation Guide.

On a side note, you cannot use accounts with blank passwords as Team Foundation Server service logon accounts.