Contoso uses Microsoft Entra Connect Sync with password writeback enabled so that cloud password resets are written back to on-premises Active Directory. Users report that when they reset their password through the SSPR portal, the reset appears to succeed in the cloud but then fails with an error indicating the on-premises directory rejected the operation. Cloud-only accounts reset without issue. Which action is most likely to resolve the writeback failures?