Your organization uses Microsoft Entra Password Protection in the cloud to block weak and banned passwords. Security wants the same custom banned-password list and lockout behavior enforced when users change their passwords directly against on-premises Active Directory domain controllers. What must you deploy to accomplish this?