Which two actions should you recommend?

You are designing an Azure Web App.
All users must authenticate by using Active Directory Domain Services (AD DS) credentials.
You need to recommend an approach to enable single sign-on to the application for domain-authenticatedusers.
Which two actions should you recommend? Each correct answer presents part of the solution.

A.
Use Forms authentication to generate claims.

B.
Use the SQL membership provider in the web application.

C.
Use Windows Identity Foundation in the web application.

D.
Use Active Directory Federation Services (AD FS) to generate claims.

Explanation:
https://msdn.microsoft.com/en-us/library/ee748475.aspx
https://msdn.microsoft.com/en-us/library/azure/dn441213.aspx