A global manufacturing company runs Active Directory Domain Services on-premises and is adopting Microsoft 365 and several Azure workloads. Security leadership requires that authentication continues to work for cloud apps even if the on-premises data center suffers a prolonged outage, that Entra ID leaked-credential detection (identity protection) can evaluate user passwords, and that the organization avoids deploying and maintaining federation server farms. As the cybersecurity architect, which Entra ID hybrid authentication design should you recommend?