The image shows the relationship between an on-premises instance of Microsoft Active Directory and an OCI region. User groups in the OCI region defined and governed by IAM policies, communicate directly with the on-premises AD instance.