AD is simply a hierarchical database of data that is DNS federated. It has a heavy lean to windward in the guise of Kerberos and LDAP. The thing about Kerb is DNS ... lol!
Our internets needed RFC1918 to squeeze a few extra decades out of a 32 bit IPv4 address. We have NAT and that means that DNS becomes difficult for identity purposes. That means that Kerberos doesn't work quite as well as originally envisaged, without some bodges. That means that you use a lot of NTLM ...
Unixs and Apples have also always relied on passwords as a first authentication method.
OK, I hate the term "best practice". There is no such thing, and MS deploys that term with complete and utter gay abandon. That is what is wrong for me. I think there is good and bad practice but never "best". There is no discussion outside of their own little minds in much of the MS documentation. I suspect this is changing right now but I have read an awful lot of MS docs over around four decades.
Authentication is hard. Trust is harder. Twatting around with phrases like "passwords are wrong" is irresponsible. You need to look at the whole chain of trust and how to authenticate it sensibly.