It seems to me that moving away from ADDS won't fit all business out there whether they're public or private. ADDS itself hasn't being "updated' or got great features compared to what cloud-based scenario has given and on the top of that MDI (Microsoft Defender for Identity) can fill in the gaps when it comes to having hybrid-environment with ADDS and other requirements. From a daily basis project standpoint perspective, PLANNING is the answer. However, having SCCM (co-managed or not) or with CMG and other security vendor features altogether increase the chances of a business not being able to move to a modern-workplace scenario (Entra ID joined only which helps to lift and shift device deployment, management with ZTA approach) and here I've seeing majority of the biggest challenges.