Consider both ways: even if you run 100% of your backend on-prems, a significant portion of your routes may go outside to reach roaming employees, remotes, maybe customers for some apps, etc. You likely have some Infrastructure-as-a-Service, dynamic subnetting and addressing for containers, VPNs, firewalls to cross, etc. AD and MS Server DCs in general are just not suited to this environment, where IPs may change on-the-fly, hosts die quickly, etc.

You typically need a more robust, web-compliant solution using e.g. tokens + MFA and web-compliant centralization of authority and certs on e.g. Consul or Red Hat Identity Management.

That being said, IMHO, it's a much saner and safer approach to bite that bullet and setup a rock-solid ID/Auth system on-prems (or at least vendor-agnostic and load-balanced over at least 2 major providers). It's really the kind of low-level infra that you can setup properly once and use for a decade, + cost of extra features you may want to add later.