Most of our clients have no Active Directory Authentication between their local Domain and the cloud. The local would be Origin and the cloud would be PA Hosted. There would be two separate logins. One for their local and one for PA Hosted.

However, you can extend the Domain Authentication to PA Hosted.