In the cloud, you no longer have a perimeter, you no longer have physical proximity, you might no longer have a web-filter or even a network at all. You are set loose, unbound from the on-prem connection. You're adrift, but you can still be in control. Azure AD centralises your users and your security, like a giant turnstile it's passport control. Intune guards the end-points - the devices and applications themselves.