The idea that Entra ID somehow replaces the control you have on premises is still...

The idea that Entra ID somehow replaces the control you have on premises is still circulating. It does not. The trust boundaries and the realities exposed by incidents like Storm-0558 show the limits clearly. On-prem AD still gives you direct command over the directory in ways the cloud identity layer cannot yet match. That gap is not going away soon, and it shapes every migration or consolidation conversation I have with IT leadership. The shift underway is that Entra ID has become non-optional infrastructure. The question is no longer whether you run it, but how you close the visibility and control differences before the next incident forces the decision. How are you mapping those trust boundaries in your own environment right now?