Your company runs an on-premises Active Directory Domain Services (AD DS) environment that is synchronized to Microsoft Entra ID using Microsoft Entra Connect. You deploy an Azure file share and need domain-joined client computers to access it using existing on-premises AD DS credentials, with NTFS-style share and file permissions enforced. Which identity source should you configure for the storage account?