A company has an on-premises SharePoint farm. The company also uses SharePoint Online. Employees must be able to access on-premises sites and SharePoint Online resources. You must use single sign-on…

Directory synchronization without password sync does not replicate password hashes to Azure AD, so users would be prompted for separate cloud credentials and true SSO would not be achieved.

Server-to-server authentication enables app-to-app trust between SharePoint and other services for app identity scenarios, and does not configure user-facing single sign-on across a hybrid environment.

Active Directory Federation Services 2.0 establishes the federation trust between the on-premises Active Directory and Azure AD, enabling users to authenticate once with their on-premises credentials and gain access to SharePoint Online resources without re-prompting.

A forward proxy configuration is required so that on-premises SharePoint servers can make outbound HTTPS connections to Office 365 and SharePoint Online service endpoints, which is necessary for hybrid features such as hybrid search and hybrid audiences to function.

Azure AD directory synchronization with password sync replicates both user account objects and password hashes to Azure AD, ensuring consistent credentials across the hybrid environment and enabling seamless SSO without requiring users to manage separate cloud passwords.