Contoso currently uses Microsoft Entra Connect with Pass-through Authentication (PTA) and Seamless SSO for its on-premises Active Directory. Management wants to ensure that users can still authenticate to cloud resources even if all on-premises PTA authentication agents or the on-premises network become unavailable for an extended period. The solution must require minimal additional infrastructure and should not depend on the on-premises domain controllers being reachable during an outage. What should you configure?