In my experience a lot of difficultly with Azure arises because a business is probably already using Azure to manage it's IT infrastructure. You then get into

In my experience a lot of difficultly with Azure arises because a business is probably already using Azure to manage it's IT infrastructure. You then get into sticky situations where IT are unhappy handing over admin access to the Ops teams: for example refusing access to AAD because it is integrated with the _corporate_ domain. This might seem fine on the surface, it's just a people issue, but it can become very tiresome when dealing with Azure resources their permissions. Worse still is some Azure resources use AAD almost like a data store: such as b2b and b2c. If you have write back enabled on your AAD (as most companies would - otherwise users wouldn't be able to self service forgotten passwords) you will _apparently_ clog up the on-premise domain with foreign objects from your b2b configuration. Of course you can get around all of this by having a separate tenant in Azure for SaaS teams/Ops only. But you introduce the headache of management (should both tenants be under a super enterprise tenant?) and single sign on (security might say there is only one user login for everything with RBAC & MFA managed from one place... now you have to join the tenants somehow...)