>AD only works if all your clients are windows. In 2018, not all of them are. We're out of a monoculture now. Doing AD SSO on other platforms is a proper pain in the butt.

That's simply untrue. Every large org I work with has unified auth with ad and a secondary package like centrify. It's trivial to get working.

And that's ignoring all the linux appliances and embeded Linux flavors (think lights out management) that support AD out of the box.