Contoso synchronises its on-premises Active Directory to Microsoft Entra ID with password hash synchronisation. You enable self-service password reset for a pilot group and confirm the users have each registered two authentication methods.
Cloud-only accounts in the pilot reset their passwords without any trouble. Every synchronised user who tries is told to contact their administrator instead. What should you do?