A company synchronizes on-premises Active Directory accounts to Microsoft Entra ID. They enable self-service password reset (SSPR) so users can reset their own cloud passwords. However, when users reset their password in the cloud, they discover they can no longer sign in to on-premises applications with the new password. Which capability must be enabled to ensure password changes made in the cloud are reflected in the on-premises Active Directory?