ADFS with web application proxy. concerning remote users only, no vpn. Azure AD Join works for remote devices, but users can't sign into the device afterwards. No azure ad connect server.

Question

ADFS with web application proxy. We have remote users only, no vpn. Azure AD Join works for remote devices, but users can't sign into the device afterwards. No azure ad connect server.

We use AD and ADFS/WAP primarily for signing into 365 for onsite applications. We have RDS servers onsite for SSO to 365. works great.

REMOTE Users/Devices.

Users with devices outside of the network (not joined to corp. domain) , trying to do azure domain join works, but can't sign in. Is there something more we need to do?
The device shows up in the Devices area in Azure AD.

The client shows in the logs: 1088 wstrust response error: failedauthentication: msis7068 access denied"