I'm testing with the new Hybrid Cloud Trust model to enable Windows Hello for Business on Hybrid Azure AD Joined clients. Everything is working fine except RDP and RemoteApps where I get an error:

An authentication error has occured.

 

The client certificate does not contain a valid UPN, or does not match the client name in the logon request.

 

Remote Computer: name_of_connection_broker_server

The certificate on the connection broker server is valid.

The documentation says the:

Unsupported Scenarios:

 

RDP/VDI scenarios using supplied credentials (RDP/VDI can be used with Remote Credential Guard or if a certificate is enrolled into the Windows Hello for Business container)

I have tried enabling and connecting with Remote Credential Guard, but the error persists. And to be honest I'm not 100% clear on what it means by enrolling a certificate into the Windows Hello for Business container.

Has anyone got this working, because I'm a bit stumped.