Contoso is deploying a hybrid identity solution with Microsoft Entra Connect. The security team has a strict requirement that no password hashes—not even encrypted or synced versions—may be stored in the cloud, and that all password validation must occur against the on-premises Active Directory in real time. Which authentication method should Contoso choose?