Contoso has three separate Active Directory forests with no trust relationships between them, all needing to synchronize users to a single Microsoft Entra tenant. The identity team wants a lightweight, agent-based solution that supports multiple disconnected forests, requires minimal on-premises footprint, and is managed from the cloud. They do NOT require synchronization of devices, pass-through authentication, or writeback of passwords beyond SSPR. Which synchronization option should you implement?