Merge pull request #7088 from ChristianMontoya/patch-3

Adding in that PKU2U must be allowed on physical device too

Author: PRMerger-2

windows-365/enterprise/connection-errors.md

@@ -35,20 +35,23 @@ The following errors can occur when connecting to a Cloud PC.
 ## Errors when connecting to an Azure Active Directory (Azure AD) joined Cloud PC
 
 ### The logon attempt failed
-**Potential cause #1**: The Cloud PC denied PKU2U protocol requests. The PKU2U protocol is only triggered in the following cases:
+**Potential cause #1**: Either the Cloud PC or the user's physical device denied PKU2U protocol requests. The PKU2U protocol is only triggered in the following cases:
 
 - The Cloud PC is Azure AD joined.
 - The user is connecting from the Windows desktop client.
 - The user's physical device is Azure AD registered, Azure AD joined, or hybrid Azure AD joined to the same organization as the Cloud PC.
 
-**Possible solution**: Turn on PKU2U protocol requests on your Cloud PC:
+**Possible solution**: Turn on PKU2U protocol requests on both the Cloud PC and the user's physical device:
 
 1. [Create a filter for all Cloud PCs](create-filter.md#create-a-filter-for-all-cloud-pcs).
 2. Create a device configuration policy [using the settings catalog](/mem/intune/configuration/settings-catalog).
 3. On the **Configuration settings** page, search for and select **Network Security Allow PKU2U Authentication Requests** > **Allow**.
 ![Screenshot with the **Network Security Allow PKU2U Authentication Requests** set to **Allow**.](./media/connection-errors/allow-pku2u.png)
 5. On the **Assignments** page, select **Add all devices** > **Edit filter** > **Include filtered devices in assignment** > select the filter you created for all Cloud PCs.
-6. Complete the creation of the device configuration policy.
+6. On the **Assignments** page, also select an Azure AD group containing the user or the user's physical device.
+7. Complete the creation of the device configuration policy.
+
+If you only manage the user's physical device through Group Policy or you don't manage the user's physical device, you (or the user) can manage this setting through the [allow PKU2U authentication requests to this computer to use online identities](/windows/security/threat-protection/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities) policy.
 
 **Potential cause #2**: [Per-user multi-factor authentication](/azure/active-directory/authentication/howto-mfa-userstates) is turned on for the user account. Because it blocks sign-in, per-user multi-factor authentication isn't supported for users connecting to Azure AD joined Cloud PCs.