Your organization already publishes an internal HR portal that has its own working authentication built on a legacy on-premises SSO product. Users navigate to this portal from the My Apps portal today only by typing the URL. Management wants the HR portal to appear as a tile in the Microsoft My Apps portal and Microsoft 365 app launcher, but they explicitly do not want Microsoft Entra ID to perform any authentication, issue any tokens, or replace the existing sign-in flow. What single sign-on mode should you configure on the enterprise application?