A retail company runs a large on-premises Active Directory forest and is adopting Microsoft Entra ID (Azure AD). Security requires that user password hashes never be stored in the cloud in any form, and that all authentication requests are always validated directly against the on-premises domain controllers. However, the operations team also wants to avoid deploying and maintaining a highly available farm of federation servers and reverse proxies. Which authentication method should you recommend?