Watchdog fails Domain join - Which OU is it testing

It will test the OU that you specify when setting up the OPNC; if you do not set an OU in the OPNC, then it will be default use the Computer container. How did you test creating a computer object in the OU? Did you create a VM in the Azure portal on the same subnet as defined in the OPNC and try doing a domain join with the Add-Computer cmdlet (which allows you to specify an OU and the djoin account)? I have had a few of my customers do this test to find out they had the djoin creds wrong; a few others had a typo in the OU DN. In some rare cases you might find that you can't talk to the DC from the subnet even though DNS will pass. Make sure your DNS settings on the VNET point to a DC or appliance that can resolve the domain name you enter in the OPNC.