
Explanation

Box1: User management occurs on-premises. Azure AD authenticates employees by using on-premises
passwords.
Azure AD Domain Services for hybrid organizations
Organizations with a hybrid IT infrastructure consume a mix of cloud resources and on-premises resources.
Such organizations synchronize identity information from their on-premises directory to their Azure AD
tenant. As hybrid organizations look to migrate more of their on-premises applications to the cloud, especially
legacy directory-aware applications, Azure AD Domain Services can be useful to them.
Example: Litware Corporation has deployed Azure AD Connect, to synchronize identity information from
their on-premises directory to their Azure AD tenant. The identity information that is synchronized includes
user accounts, their credential hashes for authentication (password hash sync) and group memberships.

User accounts, group memberships, and credentials from Litware's on-premises directory are synchronized to
Azure AD via Azure AD Connect. These user accounts, group memberships, and credentials are automatically
available within the managed domain.
Box 2: User management occurs on-premises. The on-promises domain controller authenticates employee
credentials.
You can federate your on-premises environment with Azure AD and use this federation for authentication and
authorization. This sign-in method ensures that all user authentication occurs on-premises.

References:
https://docs.microsoft.com/en-us/azure/active-directory-domain-services/active-directory-ds-overview
https://docs.microsoft.com/en-us/azure/active-directory/hybrid/whatis-fed