A company wants to extend their on-premises Active Directory to Azure.Which service should they use to enable single sign-on for both cloud and on-premises resources?