Your users will have two sets of credentials: Active Directory credentials to access on-premises services, and %BRAND_ONLINE_SERVICES% ...