Getting comfortable with cloud-based security: Whom to trust to do what

Almost every customer I deal with has been told by the big cloud providers that "AD and Identity management are some of the first things our customers move to the cloud, it's easy!" while nearly every customer tell me "that is the last thing we are going to put in the cloud" so I don't think that is actually happening, its just the largest security barrier to cloud adoption so of course the big providers are pretending its no big deal.

AD, LDAP, Access/Identity Management are very basic parts of the protection of any company's intellectual property, Defense of those systems and the networks that house them is critical, and so far, many of the cloud providers have somewhat less sophisticated and flexible options from a network isolation standpoint than you can custom build in house, plus multi-tenancy gives some security teams a bit of heartburn and that is probably completely sensible. Especially non-cloud-native applications and services sometimes were built with assumptions of security and isolation that don't exist in cloud environments in the same form. The transition can be a difficult one because many people don't understand requirements or limitations and instead are led to believe the slides and pretend that the money savings justifies drastic and risky migrations and buy into the magical thinking that "its the cloud, these guys know what they are doing and we do not"