You have a hybrid Microsoft SQL Server environment that has multiple servers and services that run in both Microsoft Azure and on-premises. If the network fails, you need to ensure that users can auth

Active Directory Federation Services (AD FS) deployed in Azure allows for federated authentication, enabling users to authenticate directly against the AD FS instances in Azure for accessing Azure-based resources and applications, even if connectivity to on-premises identity providers is lost.

Active Directory Certificate Services (AD CS) provides Public Key Infrastructure (PKI) for issuing and managing digital certificates, which is not the primary service for user authentication during a network failure.

DHCP Server is used for assigning IP addresses and does not directly facilitate user authentication or connectivity to Azure resources in the event of an on-premises network failure.

Deploying Active Directory Domain Services (AD DS) domain controllers to Azure extends the on-premises domain into the Azure virtual network, providing local domain controllers for authentication and name resolution for Azure-based resources and users, making them independent of on-premises network availability.

While DNS is crucial, Active Directory Domain Services (AD DS) includes DNS functionality, and Azure VMs typically use Azure's DNS or AD DS DNS servers within the Azure VNet, making a standalone DNS Server role less relevant for ensuring authentication during an on-premises outage.