In the past, I've used the Cisco Umbrella Active Directory Integration to on-prem DCs which imported users, groups, and computers. This allowed me to use any combination of the three identities in my policies.
We have a new customer using Azure AD I...