A company uses hybrid identity with Microsoft Entra Connect synchronizing on-premises Active Directory to Microsoft Entra ID. The IT team wants remote users to reset their own passwords from the Microsoft 365 sign-in page, and the new password must also update their on-premises AD account so they can log in to domain-joined computers. Which capability must be configured to meet this requirement?