Unsure what the purpose of this is given if you have AD -> AAD sync set up and your clients are joined to AAD, they can access on-prem resources with a Kerberos

Unsure what the purpose of this is given if you have AD -> AAD sync set up and your clients are joined to AAD, they can access on-prem resources with a Kerberos token. https://learn.microsoft.com/en-us/entra/identity/devices/device-sso-to-on-premises-resources https://learn.microsoft.com/en-us/entra/identity/devices/dev... Sure, the project has the capability to run in Docker vs a fat AD DS rollout, but that Docker project has questionable security, i.e. caching passwords (don't do that) and using TCP/389 (don't do that). Does it employ other standard AD DS-style security mechanisms, such as signing and sealing? And it bypasses MFA. Yikes.