Suppose you have configured everything correctly SSO, ADSync and mailboxes in the cloud and exchange-server on-premise in turn-off.

For some reason there is an interruption of connectivity in the company, so the cloud Office365 remains isolated from the on-premises servers (Active Directory).
Users who are not in company with such credentials will access (in the cloud are not stored passwords in Active Directory) or you have to wait for the restoration of communication with server on-premises.