Added clarifying note about DC line of sight

-------
cc: @iainfoulds

Author: MarileeTurscak-MSFT

articles/active-directory/authentication/howto-sspr-windows.md

@@ -27,7 +27,7 @@ For machines running Windows 7, 8, 8.1, and 10 you can enable users to reset the
 - Some 3rd party credential providers are known to cause problems with this feature.
 - Disabling UAC via modification of [EnableLUA registry key](https://docs.microsoft.com/openspecs/windows_protocols/ms-gpsb/958053ae-5397-4f96-977f-b7700ee461ec) is known to cause issues.
 - This feature does not work for networks with 802.1x network authentication deployed and the option "Perform immediately before user logon". For networks with 802.1x network authentication deployed it is recommended to use machine authentication to enable this feature.
-- Hybrid Azure AD joined machines must have network connectivity line of sight to a domain controller to use the new password and update cached credentials.
+- Hybrid Azure AD joined machines must have network connectivity line of sight to a domain controller to use the new password and update cached credentials. This means that devices must either be on the organization's internal network or on a VPN with network access to an on-premises domain controller. 
 - If using an image, prior to running sysprep ensure that the web cache is cleared for the built-in Administrator prior to performing the CopyProfile step. More information about this step can be found in the support article [Performance poor when using custom default user profile](https://support.microsoft.com/help/4056823/performance-issue-with-custom-default-user-profile).
 - The following settings are known to interfere with the ability to use and reset passwords on Windows 10 devices
     - If Ctrl+Alt+Del is required by policy in versions of Windows 10 before v1809, **Reset password** will not work.