The main system should be the active directory instance (or equivalent) in your office. Something you trust and that nobody will ever take away frkm you. Then

The main system should be the active directory instance (or equivalent) in your office. Something you trust and that nobody will ever take away frkm you. Then most systems can be set up to federate with external systems. Aws for example can allow identity federation via saml iirc, azure probably has something active-directory-native. Dunno for gsuite or other systems... but there probably is.