In the past I always rolled my (our) own auth but in recent years, it is so much easier to offload this to another system for so many reasons including just being more secure (policies, MFA, oauth2 pkce etc). I've used AWS Cognito which is probably one of the cheapest along with Auth0 and Okta.

I've even migrated from my (our) own to another provider and back, including provider to provider without an issue. I was initially concerned with vendor lock-in, but it hasn't been a major problem so far. With most of them it is fairly easy to migrate without any interruption to your users (including MFA!).