Most organisations do not run on cloud containers; they run on Windows Server, Active Directory and Hyper-V. This area is about keeping such environments predictable: Group Policy, virtualisation, event collection, and coexistence with newer platforms.
You do not need to buy a privileged access management system to stop logging on to workstations with a domain administrator account. Three tiers, separate accounts and a few Group Policy settings are enough.
A snapshot of a domain controller's virtual machine is not a backup of the directory. Which Active Directory failure scenarios require what, and what a full forest recovery looks like when no working domain controller is left.
A central log system without a strategy becomes an expensive warehouse of noise. How to decide which events reach the central system, in what form, and for how long.
Group Policy and an endpoint management tool can set the same things. The trouble starts when they do it at the same time. A split of responsibility that can actually be maintained.
Containers have not replaced virtual machines and will not. How to split workloads between classic virtualisation and a container platform without ideology.