You have a Microsoft 365 tenant that uses an Azure Active Directory (Azure AD) tenant. The Azure AD tenant syncs to an on-premises Active Directory domain by using an instance of Azure AD Connect…

Pass-through authentication is a sign-in method that doesn't control which Azure AD tenant an Azure subscription is associated with or the presence of user accounts within a tenant.

Federated authentication (like ADFS) is a sign-in method and does not dictate the association between an Azure subscription and an Azure AD tenant, nor the user accounts available within that tenant.

Azure subscriptions are intrinsically linked to a single Azure AD tenant, which serves as the identity provider for all resources within that subscription. If a new subscription is associated with a different Azure AD tenant that does not contain the synced user accounts, those users cannot be assigned roles. Changing the directory of the new subscription to the existing Azure AD tenant where the synced users are present will resolve this access issue.

Configuring a second instance of Azure AD Connect would typically sync another on-premises AD to an Azure AD tenant or add redundancy, but it does not address the fundamental problem of the new subscription being linked to the wrong Azure AD tenant.