Contoso uses Entra Connect to synchronize identities from an on-premises Active Directory. You enable self-service password reset (SSPR) for all cloud users. During testing, hybrid users can reset their Entra ID password, but the new password is not applied to their on-premises AD accounts, causing them to fail to sign in to domain-joined workstations. What must you configure to resolve this?