You are considering integrating Azure with your on$-$premises datacenter and you want to start with identity. You want a lightweight footprint on your on$-$premises servers. At the moment, you are only concerned with making sure your users can authenticate to the cloud without having to enter their credentials again after they have authenticated to the on$-$premises Active Directory. You also want to be sure that when users change their password, they are subject to on$-$premises policies. Which collection of Azure services should you deploy?