A security engineer is implementing Microsoft Entra ID Password Protection to prevent users and AI automation scripts from using weak or organization-specific banned passwords when rotating credentials. The organization has an on-premises Active Directory. Which component must be deployed to extend Entra ID Password Protection to on-premises AD?

The correct choice is the Microsoft Entra ID Password Protection proxy service and DC agent deployed on on-premises domain controllers. Microsoft Entra ID Password Protection for on-premises Active Directory requires two components: the Entra ID Password Protection proxy service, installed on domain-joined servers to communicate with Entra ID, and the DC agent installed on each domain controller. The DC agent enforces the banned password list, including both Microsoft's global list and the organization's custom banned passwords, during all password change operations on the domain controller. The Microsoft Entra Connect with password writeback feature enabled option is incorrect because password writeback synchronizes passwords from Entra ID to on-premises AD; it does not extend Entra ID Password Protection enforcement to on-premises AD password changes. The Microsoft Identity Manager with a password synchronization management agent option is incorrect because Microsoft Identity Manager is an identity management platform and is not required or used for Entra ID Password Protection deployment. The Microsoft Entra Kerberos server deployed in the on-premises domain option is incorrect because Microsoft Entra Kerberos server enables passwordless and FIDO2 authentication for on-premises resources, not password protection enforcement.