Active Directory for everything internal

external stuff is managed via Teampass (on premise shared pw manager), which supports shared credentials and user-only credentials

although teampass is a bit wonky at times, it works pretty well for us