When a user enters their username and password into the %BRAND_AZURE_ACTIVE_DIRECTORY% login page, %BRAND_AZURE_ACTIVE_DIRECTORY% ...

When a user enters their username and password into the %BRAND_AZURE_ACTIVE_DIRECTORY% login page, %BRAND_AZURE_ACTIVE_DIRECTORY% places the username and password in the appropriate on-premises connector queue for validation. One of the available on-premises connectors then retrieves the username and password and validates it against Active Directory. The validation occurs over standard %BRAND_WINDOWS_SHORT% APIs similar to how Active Directory Federation Services validates passwords.