Merge pull request #9667 from ChristianMontoya/patch-2

AB#7379: Add connection error - Entra ID Conditional Access

Author: ryanberg-aquent

support/azure/virtual-desktop/troubleshoot-service-connection.md

@@ -41,6 +41,18 @@ This could also happen if a CSP Provider created the subscription and then trans
 3. In the menu on the left side of the page, select **Resource provider**.
 4. Find and select **Microsoft.DesktopVirtualization**, and then select **Re-register**.
 
+## User sees Conditional Access error preventing access to Microsoft Entra ID resource
+
+This error occurs when the user is subject to a Conditional Access policy that's blocking access to a specific Microsoft Entra ID resource, either when signing into the Windows App or when making a connection to a resource. This usually happens for one of two reasons:
+
+- The user is trying to sign in with the Windows App either on Windows or in a web browser but doesn't have access to both the Azure Virtual Desktop and Windows 365 apps through Conditional Access policies.
+  > [!NOTE]
+  > The Windows App will try to authenticate the user to both these apps even if the user isn't assigned a Windows 365 Cloud PC.
+
+- The user is signing into a resource with Microsoft Entra-based single sign-on configured but doesn't have access to the Windows Cloud Login app through Conditional Access policies.
+
+To resolve this, first validate the user's [sign-in identity](/entra/identity/monitoring-health/concept-sign-ins) and then see [Enforce Microsoft Entra multifactor authentication for Azure Virtual Desktop using Conditional Access](/azure/virtual-desktop/set-up-mfa).
+
 ## Next steps
 
 - For an overview on troubleshooting Azure Virtual Desktop and the escalation tracks, see [Troubleshooting overview, feedback, and support](/azure/virtual-desktop/troubleshoot-set-up-overview).