Missing basic features like the ability to force users to reset their passwords, use 2FA from authenticator apps, enforce strong passwords and other password policies.