Comment by zweifuss

If you can do a successful switch to cloud only Entra (aka. AzureAD) first, you are 90% ready for a migration to Open Source. You need Entra for Licensing anyway. Yes, I'm aware that this is hard.

Univention Nubus (Keycloak + OpenLDAP) or FreeIPA as alternatives for Entra come to mind. You can even leverage your Powershell expertise.