Microsoftkwester-ebbinghaus-business
Oh, I'm not saying "copy" should replace a full RBAC model, but it does have its uses, for either quick testing or when a RBAC doesn't exist, and local IT (if any) is not familiar with Powershell - which is quite common with small/medium business.
One thing they appreciate is to copy a given "template" user (with a predefined role and thus corresponding security groups) to create a new user.
Thanks for the advice about DSAC search - I gave up on it a long time ago, to rely on ADUC and Powershell instead. I'll give it another try.
I guess DHCP/DNS/AD extensions are owned by their respective product groups, which in turn focus all their efforts on Azure and/or are reducing to a one-man army at best (AD ?). We shouldn't expect much more on this side sadly.
