Question however is, can we use PaaS services like WebApps and AzureSQL and still connect to on-premise CA SM ?
I guess YES! We do support PASSIVE Profile (Web Browser based) in versions lower that R12.52 SP1 CR04. So if is a Web Browser based access, then we can use OnPrem (lower than R12.52) CA SSO to SSO into Cloud.
Here is a table