Ditch your domain joins and IWA in favor of single sign-on