Contoso Legal LLP

Cloud-only tenant: accounts are created and managed in Microsoft 365, not synced from an on-premises Active Directory.

Managed domains sign in through Entra ID (checking synced passwords in the cloud, or on-premises with pass-through authentication). Federated domains send sign-in to another identity provider, usually AD FS: if it is down, those users can't sign in.

Synced accounts are managed in Active Directory: changes made to them in Microsoft 365 are overwritten at the next sync.