Your on-premises network contains an Active Directory Domain Services (AD DS) domain. The domain contains a server named Server1 that hosts an app named App1. App1 uses Active Directory…

The BlockCloudAccountTakeoverThroughHardMatch feature is designed to prevent specific account takeover scenarios during hard matching, not to enable authentication for cloud-originated users to on-premises AD DS apps.

Password writeback is a feature of Microsoft Entra Connect sync that allows passwords changed or set in Microsoft Entra ID to be synchronized back to the on-premises Active Directory Domain Services (AD DS). For User1, who exists in Microsoft Entra ID, to authenticate to an on-premises application that relies on AD DS, their password must be present and valid in the on-premises directory, which password writeback facilitates.

While User1 needs an account in AD DS, simply creating it manually doesn't ensure its password will synchronize from Microsoft Entra ID or resolve password consistency issues if the user's password is managed in the cloud.

Disabling soft match would affect how Microsoft Entra Connect matches objects, but it does not enable a cloud-only user's password to be available for on-premises AD DS authentication.