Azure AD and Intune is good enough right now if you don’t need local servers for apps, and very cheap (or maybe free) depending on what you buy from Microsoft.

Azure AD and Intune is good enough right now if you don’t need local servers for apps, and very cheap (or maybe free) depending on what you buy from Microsoft. It can secure a device, apply ADMX files, install applications, and if you need more complexity then you can run PowerShell scripts. It’s not really user friendly, but AD and GPO never really was either. Did I mention no CALs?