What do people not like about Azure IAM? That's the one I'm most familiar with, and I've always thought it was decent, pretty vanilla.

When I go to AWS it looks similar except role assignments can't be scoped, so needs more duplication and maintenance. In that way Azure seems nicer. In everything else, it seems pretty equivalent.

But I see it catching flak occasionally on HN, so curious what others dislike.