A company has hybrid identity with Microsoft Entra Connect. The security team detects a Golden Ticket attack against the on-premises Active Directory. After remediating the on-premises compromise, which Microsoft Entra ID action is required to prevent the attacker from using synced credentials?

B is correct because after a Golden Ticket attack on on-premises AD, all synced user passwords should be reset, and the AZUREADSSOACC (Seamless SSO computer account) password must be rotated twice to invalidate any forged Kerberos tickets that could be used for Seamless SSO authentication in the cloud. A is incorrect because a delta sync alone does not invalidate existing tokens or address the security of SSO-related accounts. C is incorrect because disabling password hash sync does not address the already-compromised credential hashes that may be in use. D is incorrect because Smart Lockout addresses brute force attacks, not the use of forged Kerberos tickets from a Golden Ticket attack.