Your network contains an on-premises Active Directory Domain Services (AD DS) domain.

Microsoft Entra pass-through authentication (PTA) enables users to authenticate to Microsoft 365 using their existing on-premises Active Directory credentials while ensuring that password validation occurs against the on-premises Active Directory environment.

With pass-through authentication, Microsoft Entra ID receives the cloud sign-in request and communicates with a pass-through authentication agent installed on an on-premises, domain-joined Windows Server.

The agent validates the submitted credentials against Active Directory Domain Services and returns the authentication result to Microsoft Entra ID.

This approach allows organizations to maintain password validation against their existing domain controllers while providing users with access to Microsoft 365 cloud services.

Option B is incorrect because Microsoft Entra seamless single sign-on reduces authentication prompts for domain-joined users but does not independently determine where password validation occurs.

Option C is incorrect because certificate-based authentication uses X.509 certificates rather than authenticating users through their existing domain passwords.

Option D is incorrect because password hash synchronization enables Microsoft Entra ID to validate passwords in the cloud using synchronized password hashes. It does not satisfy the requirement that password authentication occur against the on-premises domain.

Pass-through authentication therefore meets both requirements.

Microsoft References:

https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-pta