Microsoft Entra ID really the only option

We use Microsoft Entra ID to be the source of truth for all our identity needs. It allows us to create, change and delete users who pass through our organization, and provide access to those users authorized to do so. Microsoft Entra ID is easy to use once you have a bit of time in there, and although there are a few caveats, most of the time it's rock solid and makes identity and security a breeze.

We used to have a hybrid solution, with on-prem AD and it replicated up to Microsoft Entra ID. We recently moved to full-cloud Entra and have been very happy with it.

Yes, we use Microsoft Entra ID to provide OIDC and SAML Single Sign On. I was also able to prohibit the addition of non-Microsoft apps by users by creating a policy that required admin consent to add anything. That greatly reduced our risk and the list of non-approved apps

The end user experience has greatly improved now that we are off the hybrid AD solution. Users no longer need to use a VPN to change their passwords (we are fully remote with no offices), Users can do Self Service Password Resets, onboarding new employees is much faster and modernized. It's a win-win for both the users and me as an admin.