Says who? Havent had any problems over 4+ years.

Regular Active Directory Domain Services works great.

Sane MFA apps explicitly disallow their data from being backed up. That would be a massive attack vector if it was possible.

1. Automated certs (from 2 different CAs, not just LE) are baked in and require ZERO configuration.

2. Configuration simplicity, most of my proxied services take 3 lines total each.

Caddy. A reverse proxy / web server with automated LE certs that is easier than this does not exist.