azure-ad-sso-deferred-local-auth-migration-path

Azure AD SSO for internal platforms should be deferred until the organization’s AD provisioning work is complete — implementing it prematurely against an incomplete AD causes integration churn. v1 pattern: full local auth (argon2id + mandatory TOTP) with stub interfaces ready. Migration path when AD is ready: dual-mode login → per-user email-match against AD → deprecate local accounts.