You can import user accounts from your on-premises Active Directory into ServiceDesk Plus Cloud and keep the accounts periodically synchronized. This is achieved by installing and running a small foot-print Windows application called the 'Provisioning App' in your on-premises infrastructure.
More details about the Provisioning tool is available here: https://www.manageengine.com/products/service-desk/provisioning-app.html
To allow users to authenticate with ServiceDesk Plus using their Active Directory credentials, you need to install the Active Directory Federation Service (ADFS) and setup SAML authentication between ServiceDesk Plus and ADFS.
ServiceDesk Plus offers support for SAML 2.0, which facilitates integration with federated identity management solutions for user authentication. ServiceDesk Plus acts as the SAML Service Provider (SP) and it integrates with SAML Identity Providers (IdP). The integration involves supplying details about SP to IdP and vice-versa. Once you integrate ServiceDesk Plus with an IdP, users can log in to ServiceDesk Plus from the respective identity providers GUI without supplying credentials. You can set up Active Directory Federation Service (ADFS) as the IdP to allow your users to log in to ServiceDesk Plus with their Active Directory credentials.
Refer here for detailed steps for configuring SAML Authentication
To enable users log in to the application using their User Principal Name (UPN ID), ServiceDesk Plus On Demand allows SDAdmins/OrgAdmins to add a secondary email to user accounts via CSV import or provisioning tools. However, the user details page does not display the secondary email since it is used only for login purposes.
OrgAdmin/SDAdmin can update the secondary email of users at any stage via CSV import or provisioning tools.