Your organization uses Azure Virtual Desktop with session hosts that are Microsoft Entra hybrid joined to an on-premises Active Directory Domain Services (AD DS) domain synchronized to Microsoft Entra ID. Users authenticate to session hosts and then need to access on-premises file shares and internal web apps that rely on Kerberos authentication. You want users to sign in to the session hosts with FIDO2 security keys (passwordless) while still being able to access the Kerberos-protected on-premises resources without a password prompt. Which feature must you enable to make this scenario work?