Azure Active Directory manages this well. If your company uses office365, it's likely you already are using this under the hood.