Error Code 0x9735 from Entra ID joined devices

Nethmina Gamage

I recently ran into an interesting error with a customer where they’ve implemented the latest CIS security baselines for Windows 11 and were unable to connect to Azure Virtual Desktop (AVD) on their Entra ID joined devices.

Here’s the error we saw:

Error message detail:

Couldn’t connect.

Something went wrong when we tried to connect. If this keeps happening, ask your admin or tech support for help.

Error code: 0x9735

Extended error code: 0x0

Activity ID:

The Solution:

The solution was to enable AllowPKU2UAuthenticationRequests which allows authentication requests to use online identities.

Microsoft has documented this already.

The Policy CSP is below

./Device/Vendor/MSFT/Policy/Config/LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests

While you can find the GPO setting here:

Local Policies Security Options

Network security: Allow PKU2U authentication requests to this computer to use online identities. This policy will be turned off by default on domain joined machines. This would prevent online identities from authenticating to the domain joined machine.

Testing:

The solution was tested using the Windows App, and not the Remote Desktop AVD client.

Risks:

There are some security implications to this change, beyond remote sessions. Check this Tenable article for more info.

While this was a straightforward change, it was tricky to track down. Hopefully this helps you to a faster fix. We’d love to hear how your experience went.

Published On: February 21st, 2025