Security isn’t built on tools,
It’s built on identity foundations,
And in most Microsoft environments that foundation starts with Active Directory.
On Prem, cloud or hybrid.
SC-900 makes this clear early on,
If identity is weak, everything built on top of it is exposed.