Merge pull request #7189 from ChristianMontoya/patch-4

New FAQ item for device compliance policies and Cloud PCs

Author: Angela Fleischmann

windows-365/enterprise/known-issues-enterprise.md

@@ -40,7 +40,7 @@ A [resize](resize-cloud-pc.md) of a Cloud PC eliminates all existing [restore](r
 
 ## Windows doesn’t scan for software updates until the first time a user signs in<!--38212344-->
 
- While a Windows PC (physical or Cloud PC) sits idle before the first user signs in, Windows Update doesn’t scan for or install monthly quality patches. This means that the PC might miss important security updates. Without the latest security updates, the device is exposed to security vulnerabilities.
+While a Windows PC (physical or Cloud PC) sits idle before the first user signs in, Windows Update doesn’t scan for or install monthly quality patches. This means that the PC might miss important security updates. Without the latest security updates, the device is exposed to security vulnerabilities.
 
  **Troubleshooting steps**: Make sure that a user signs in to new Cloud PCs as soon as possible.
 
@@ -51,7 +51,7 @@ Windows 365 provisioning failures may occur because both:
 - the Desired State Configuration (DSC) extension isn't signed and
 - the PowerShell Execution policy is set to Allsigned in the Group Policy Object (GPO)
 
-**Troubleshooting steps**: Follow these steps:
+**Troubleshooting steps**: 
 
 1. Did the on-premises network connection (OPNC) fail with the following error: `"An internal error occurred. The virtual machine deployment timed out."`?
 2. If yes, review the related GPO. Is PowerShell Execution set to AllSigned?
@@ -64,6 +64,24 @@ Only the default Enrollment Status Page (ESP) profile is supported for Windows 3
 
 For default ESP profiles, when using hybrid Azure Active Directory (Azure AD) Join, you must set the **Only show page to devices provisioned by out-of-box experience (OOBE)** setting to **No**.
 
+## Cloud PC reports as not compliant for compliance policy
+
+The following device compliance settings report as **Not applicable** when being evaluated for a Cloud PC:
+
+- **Trusted Platform Module (TPM)**
+- **Require encryption of data storage on device.**
+
+The following device compliance settings report as **Not Compliant** when being evaluated for a Cloud PC:
+
+- **Require BitLocker**
+- **Require Secure Boot to be enabled on the device.**
+
+**Troubleshooting steps**: 
+
+1. [Create a filter for all Cloud PCs](create-filter.md#create-a-filter-for-all-cloud-pcs).
+2. For any existing device compliance policies that both evaluate to a Cloud PC and contain either of the **Not Compliant** settings, use this new filter to exclude Cloud PCs from the policy assignment.
+3. Create a new device compliance policy without either of the **Not Compliant** settings and use this new filter to include Cloud PCs for the policy assignment. 
+
 ## Next steps
 
 [Troubleshoot Windows 365 Enterprise Cloud PC](troubleshooting.md)