In the Administering Windows Server Hybrid Core Infrastructure material, the section on Configure and manage Azure AD Password Protection states that Azure AD Password Protection "uses a global and custom banned password list to prevent weak or easily guessed passwords." Administration is performed in Azure AD: "The custom banned password list is created and maintained in the Azure AD portal and applies to both cloud users and on-premises domains when the proxy and DC agents are deployed." The guidance further notes that the feature is case-insensitive and blocks substrings: "Words on the custom list are evaluated in all variants and as part of longer strings." Operationally, you configure this at Security # Authentication methods # Password protection (Azure AD admin center). From there you add entries such as "contoso" to the Custom banned password list, and set enforcement/audit. The same module clarifies what you don't use: "Active Directory Users and Computers does not manage Azure AD Password Protection policy," and tools like Synchronization Service Manager or Windows Admin Center are unrelated to defining the password policy.
Therefore, to prevent users from including Contoso in their passwords in a hybrid (Azure AD Connect) environment, you must configure the custom banned password list in the Azure Active Directory admin center.