Re: Microsoft?
AD is primarily a real user identity service—it existed long before JWTs were floating along the neurons in its creator's brain... And honestly, I wouldn't be surprised if someone, somewhere already made that. Or that somewhere in the Microsoft tech stack, your desired feature already exists in some form or another.
No, I don't mean "Active Directory can do everything that Active Directory can do", and I was only using that as an example. The realm of built-in software you can provision on a fresh Windows Server device is massive, and AD is only one part of it. If you're a startup that needs basic identity management, install Windows server, tick a box, go through the wizard, and you're done. It's incredibly simple to get started, you can add hundreds of thousands of users with great performance, you have a slew of third party software at your disposal to bolt on to it, and it's basically LDAP under the hood so anything that speaks LDAP can also (generally) speak to AD.
Need certs? Tick the box that turns your server into a certificate authority, use a web-based interface to generate and dispense certs.
Need web server? IIS.
Etc etc.
Are each of these products best in class? Absolutely not. Once you have to administrate them for a while you'll find plenty of headaches. Everything you said is correct.
My point is the barrier to entry is very, very low, and the ecosystem is as wide as it is deep.
Think of it like buying into Apple. You don't just get an iThing for its iFeature, you get it because it gets you access to all the other iFeatures that Apple gives you, like Air Drop, iCloud, the built-in VPN thing, using your iPad as a secondary monitor wirelessly. All those features are a click away and require absolutely zero futzing around to use. That's why people are attracted to Microsoft.
(Even if after purchase you find out that, actually, there's a lot of futzing around to be had... that's neither here nor there though.)
Yes, AD and the rest don't do everything. I didn't insinuate that. But for the needs of the vast majority of companies, which is the implied demographic behind those that "need it", it's sufficient. None of it is nowhere near the best at what it does and there are plenty of better options. But you get a lot for the ecosystem you jump into.