Updating errors to be more specific on W365 errors page

Author: ChristianMontoya

windows-365/enterprise/connection-errors.md

@@ -34,12 +34,25 @@ The following errors can occur when connecting to a Cloud PC.
 
 ## Errors when connecting to an Azure AD join Cloud PC
 
-**Potential cause**: Possible causes for connection errors include:
+### The logon attempt failed
+**Potential cause**: The Cloud PC VM is denying PKU2U protocol requests. The PKU2U protocol is only triggered in the following cases:
 
-- Windows sign-in works directly against Azure AD, potentially triggering Azure AD authentication controls.
-- Sign-in attempts from the Windows desktop client to a Cloud PC use a different protocol, called PKU2U.
+- The Cloud PC is Azure AD joined.
+- The user is connecting from the Windows desktop client.
+- The user's physical device is either Azure AD registered, Azure AD joined, or Hybrid Azure AD joined to the same organization as the Cloud PC.
 
-**Possible solution**: Follow the guidance to [troubleshoot connections to Azure AD joined VMs](/azure/virtual-desktop/troubleshoot-azure-ad-connections?context=/windows-365/context/pr-context).
+**Possible solution**: Enable PKU2U protocol requests on your Cloud PC. To do this:
+
+1. [Create a filter for all Cloud PCs](create-filter).
+2. Create a device configuration policy [using the settings catalog](/mem/intune/configuration/settings-catalog.md).
+3. On the **Configuration settings** page, search for and select **Network Security Allow PKU2U Authentication Requests**, then select **Allow**.
+![Screenshot with the **Network Security Allow PKU2U Authentication Requests** set to **Allow**.](./media/allow-pku2u.png)
+5. On the **Assignments** page, select **Add all devices** > **Edit filter** > **Include filtered devices in assignment** > select the filter you created for all Cloud PCs.
+6. Complete the creation of the device configuration policy.
+
+**Potential cause**: [Per-user multi-factor authentication](/azure/active-directory/authentication/howto-mfa-userstates) is enabled for the user account. Per-user multi-factor authentication is not supported for users connecting to Azure AD joined Cloud PCs since it blocks login.
+
+**Possible solution**: Disable per-user multi-factor authentication for all users connecting to Cloud PCs. Then, [set an Azure AD conditional access policy](set-conditional-access-policies) and assign it to the appropriate users.
 
 ## Specific connection errors