Your organization uses Microsoft Entra Cloud Sync (not Connect Sync) to synchronize users from a single on-premises Active Directory forest. Users report that their on-premises passwords do not work when signing in to Microsoft 365, although the user accounts themselves appear correctly in Entra ID. You confirm the sync agent is healthy and objects are provisioning successfully. What is the MOST likely cause?