Your on-premises environment has an AD DS domain contoso.com with a domain controller dc1.contoso.com. In Azure you have several virtual networks (details in the scenario). You plan to deploy Windows 365 Enterprise Cloud PCs using Microsoft Entra hybrid join. Which virtual network can be used for the Azure network connection (ANC)?

VNet1 is the correct choice because it has a site-to-site VPN connection to the on-premises network where the domain controller (dc1.contoso.com) resides. For Microsoft Entra hybrid join, Cloud PCs must be able to communicate with an on-premises domain controller to join the Active Directory Domain Services (AD DS) domain. VNet2 and VNet3 lack this critical connectivity, making them unsuitable for hybrid join scenarios. Without direct line-of-sight to the domain controller, the Cloud PCs cannot complete the domain join process required for hybrid join.