Azure Active Directory works well to securely move into the cloud

I've only had to open a few support cases with Microsoft for Azure AD. In each time it was because there was a sync error between our on-premise database (the local copy of the AD) and Azure's copy. The AAD copy of the AD has some user and computer attributes that admins can't change using the AAD console. But that's so that we, as humans, don't accidentally break the database. Whenever there has been a sync conflict that i could not resolve following there (usually excellent) instructions for doing so, I have opened a support case. I can count those cases on one hand after nearly three years of lice production use of AAD. Each of those cases was resolved within a few days and in no circumstance was the affected user or computer unable to authenticate, although they may have been unable to access their email for a brief period during the troubleshooting. It's quite a bit better than other Microsoft support, in my opinion.

Azure AD is actually required for Office 365 to work, so obviously you won't have a choice about whether or not it is well-suited unless you want to skip Office 365 completely. But it's actually a good standalone AD solution for when you don't want to own any infrastructure at all. That's because AAD is hosted by Microsoft in their commercial cloud, Azure. You could hypothetically build all a full corporate directory against which to authenticate without having to own a single server.

I would not advise using AAD as your network directory as a standalone solution, however. You would need to have at least one on-premise AD domain controller with a full copy of the directory, at all times. This is required because Azure Active Directory operates in the cloud, meaning it is reached by way of the internet. If any site were to become disconnected from the internet for any reason, and if there is NOT a local copy of the directory on a domain controller that the users and computers can reach from their devices, no one would be able to authenticate to any resources until connectivity is restored.