@Jackie Butler Thanks for reaching out. After the sync from on prem to Azure AD, the user can start logging in with username like abc@keyman .com to Services.
When you have a sync in place, and you do not have any user on Azure AD. The on prem Azure AD connect synchronizes the users from on prem to cloud.
If there is a scenario that the same user is present in both in on prem and cloud, the on prem azure ad connector uses a soft match and hard match to match the user with the azure AD user.
This is discussed here : https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-install-existing-tenant#sync-with-existing-users-in-azure-ad
For the password part, If you choose password sync, the passwords are synchronized to Azure AD, so that the end users can still use the on prem password for logging to services.
You can actually see the following decision tree to decide which authentication method you want ?
This article will certainly help you decide, please have a look here : https://learn.microsoft.com/en-us/azure/active-directory/hybrid/choose-ad-authn
-----------------------------------------------------------------------------------------------------------------
If the suggested response helped you resolve your issue, please do not forget to accept the response as Answer and "Up-Vote" for the answer that helped you for benefit of the community.