A company is deploying a pooled Azure Virtual Desktop host pool to run a legacy line-of-business application that requires Kerberos authentication and Group Policy for configuration. The organization is fully cloud-based with identities in Microsoft Entra ID only; there are no on-premises domain controllers and no site-to-site VPN or ExpressRoute connectivity. Users must be able to sign in to the session hosts and have the application authenticate using traditional domain services. Which identity solution should you implement for the session hosts?