Policy requires hybrid users' passwords to be validated against on-premises Active Directory through supported agents during sign-in. Which authentication approach fits?

1. Pass-through authentication
2. A B2B invitation alone
3. A group-based license assignment
4. Password hash synchronization as the same agent-per-sign-in path