add new section

Author: Deland-Han

support/windows-365/troubleshoot-azure-network-connection.md

@@ -27,6 +27,23 @@ When a Cloud PC is provisioned, it's automatically joined to the provided domain
 - You troubleshoot domain join failures like any physical computer in your organization.
 - If you have a domain name that can be resolved on the internet (like `contoso.com`), make sure that your Domain Name System (DNS) servers are configured as internal. Also, make sure that they can resolve Active Directory domain DNS records, not your public domain name.
 
+If you encounter the following errors in your ANC health checks, consider the following suggestions to ensure your Azure and on-premises configurations can successfully reach the required Windows 365 endpoints:
+
+> Internal Server Error
+
+> InternalServerErrorUnableToRunDscScript
+
+### Domain controller line of sight
+
+Successful communication with a domain controller within your organization is essential for configuring an ANC to allow hybrid domain-joined Cloud PCs. Ensure that the Azure vNet used for your ANC connection has a network route to a domain controller and ensure that your DNS setup can successfully resolve it.
+
+> [!NOTE]
+> This section only applies to hybrid environments.
+
+### ANC Endpoint Access
+
+During ANC configuration, the service needs to download configuration data from various Microsoft endpoints as listed in [Network requirements](/windows-365/enterprise/requirements-network). Failure to reach these endpoints due to misconfigured network settings can lead to a failure. To ensure successful access, Transport Layer Security (TLS) inspection should be avoided on any vNET used for ANC connections. Ensure that you can successfully resolve and reach these endpoints through the Azure vNet used and ensure that any firewall, proxy, or other Network services employed within the network allow access to them.
+
 <a name='azure-active-directory-device-sync'></a>
 
 ## Microsoft Entra device sync