Contoso runs an on-premises Active Directory Domain Services (AD DS) forest and wants to enable users to sign in to Microsoft 365 and Azure resources with the same credentials. A key requirement is that user authentication must continue to succeed even if the on-premises servers or the network link to Azure become temporarily unavailable. The security team also mandates that password hashes stored in the cloud must not be usable to reconstruct the original plaintext passwords. Which authentication method should you recommend?