I’d normally agree, but keeping it tied to AD is nice, and data exfiltration is a major enough concern for my environment that third-party cloud storage is thoroughly blocked.