A hybrid organization wants cloud sign-in to verify synchronized password-derived hashes without depending on a live on-premises authentication agent for each sign-in. Which approach fits?

1. AD FS federation as having no on-premises dependency
2. Password hash synchronization
3. A DNS forwarder
4. Pass-through authentication as the same cloud-only verification path