How to use on-prem AD as the Identity Source for CDO?

Just test migrate 2 devices from on-prem FMC to CDO, the migration process mostly went smooth, and brought all objects, NAT/ACL rules to cloud. However, our site is a hybrid AD/Azure site, how should I proceed to let CDO knows about our on-prem AD? Some agents?