Adding in that PKU2U must be allowed on physical device too

Author: ChristianMontoya

windows-365/enterprise/connection-errors.md

@@ -35,13 +35,13 @@ The following errors can occur when connecting to a Cloud PC.
 ## Errors when connecting to an Azure Active Directory (Azure AD) joined Cloud PC
 
 ### The logon attempt failed
-**Potential cause #1**: The Cloud PC denied PKU2U protocol requests. The PKU2U protocol is only triggered in the following cases:
+**Potential cause #1**: Either the Cloud PC or the user's physical device denied PKU2U protocol requests. The PKU2U protocol is only triggered in the following cases:
 
 - The Cloud PC is Azure AD joined.
 - The user is connecting from the Windows desktop client.
 - The user's physical device is Azure AD registered, Azure AD joined, or hybrid Azure AD joined to the same organization as the Cloud PC.
 
-**Possible solution**: Turn on PKU2U protocol requests on your Cloud PC:
+**Possible solution**: Turn on PKU2U protocol requests on both the Cloud PC and the user's physical device:
 
 1. [Create a filter for all Cloud PCs](create-filter.md#create-a-filter-for-all-cloud-pcs).
 2. Create a device configuration policy [using the settings catalog](/mem/intune/configuration/settings-catalog).
@@ -50,6 +50,8 @@ The following errors can occur when connecting to a Cloud PC.
 5. On the **Assignments** page, select **Add all devices** > **Edit filter** > **Include filtered devices in assignment** > select the filter you created for all Cloud PCs.
 6. Complete the creation of the device configuration policy.
 
+If the user's physical device is managed, assign the user or the user's physical device to the same device configuration policy. If the user's physical device is unmanaged or you manage through Group Policy, create a Group Policy Object (GPO) to [allow PKU2U authentication requests to this computer to use online identities](/windows/security/threat-protection/security-policy-settings/network-security-allow-pku2u-authentication-requests-to-this-computer-to-use-online-identities).
+
 **Potential cause #2**: [Per-user multi-factor authentication](/azure/active-directory/authentication/howto-mfa-userstates) is turned on for the user account. Because it blocks sign-in, per-user multi-factor authentication isn't supported for users connecting to Azure AD joined Cloud PCs.
 
 **Possible solution**: [Remove per-user multi-factor authentication](/azure/active-directory/devices/howto-vm-sign-in-azure-ad-windows#mfa-sign-in-method-required) for all users connecting to Cloud PCs. Then, [set an Azure AD conditional access policy](set-conditional-access-policies.md) and assign it to the appropriate users.