It absolutely does. I was just like you. There is always a way to domain admin. Nobody ever said don't protect your endpoints if you're not in the cloud. You protect them the same way you do if they are hybrid joined, just using a different technology. I helped build a cloud native org. We implemented STIGs on all our endpoints. They all had the slew of security point solutions too: SASE, EDR, Endpoint DLP, Insider Threat, ASR, etc. What I'm talking about has nothing to do with Entra. It's about moving employee devices out of AD to reduce attack surface because they don't need to be there and it reduces an incredible amount of attack surface. This has been a recommended best practice for a couple years now since Secure Future Initiative. Let me ask you something: How many times have you gotten domain admin or global admin from a device that was unable to talk to Active Directory? Active Directory is legacy and highly insecure in every organization I've consulted with. I thought security people were supposed to help people get off legacy and follow documented best practices? The reality with configuration based security improvements on-prem is not just that they are expensive. It's that the CIA triad includes availability and pentesters don't appreciate the services that get taken down in Sev1 and Sev2 incidents or degraded when you have to try to fix things on-prem. It's easy to say in a report, much harder to achieve in reality when the business requires you to be available all the time with no issues because that service that might be affected makes the company a million dollars a day. Why would the security community at all be advocating for increased attack surface? Access to shares, mapped drives, and NAS don't require domain admin for atatckers to smash and grab. Access to databases often leads to privilege escalation and ability to exfil from tier 2. If Tier 2 should be treated as hostile, why not remove it? Again, it's a documented best practice. I, like you, got domain admin on every engagement except one (because they didn't want me to). How often was I able to achieve that from a cloud only device? Just a couple times. It's significantly harder to compromise a global admin in that scenario unless you phish them directly or land on a device in a privileged role.

I will extend this advice and say to move your employee endpoints out of AD and manage them in the cloud. There's no need for them to be hybrid joined anymore.