> IT never even has to be in the same zipcode as the new laptop or ever remotely connect to it to perform maintenance tasks.

That sounds nice, but that's not exactly a feature specific to AD.

All perfectly possible with a couple well placed scripts and some remote logins.

> TPM-backed certificates/WebAuthn for securing web apps or anything behind MS-linked SSO

Yeah this is the overengineered stuff that is therefore difficult to replicate. Certs and auth predate AD and Azure, the lock-in comes from the overcomplicated SAML style rickety tower of doom that just barely functions...