You should enable Pass-through authentication. This will allow your organization's users to use single sign-on (SSO) in order to securely access resources both in your on-premises network as well as in Azure AD. When users try to access Azure AD from the on-premises network, they will never need to enter their passwords. An additional feature of Pass-through authentication is that these passwords are never stored in the cloud, thus meeting the security requirement of the scenario. When configuring Pass-through authentication using the Azure AD Connect application an additional step is to ensure that the Enable single sign-on box has been checked.