This was fairly simple after I found the right combination of articles.

https://our.umbraco.com/documentation/reference/security/

https://stackoverflow.com/questions/290548/validate-a-username-and-password-against-active-directory

1. install nuget package "System.DirectoryServices.AccountManagement"
2. create the password checker class

3. Add the password checker to services in startup.cs

   using System.DirectoryServices.AccountManagement;
   
   
   public class MyPasswordChecker : IBackOfficeUserPasswordChecker
   {
       public Task<BackOfficeUserPasswordCheckerResult> CheckPasswordAsync(BackOfficeIdentityUser user, string password)
       {
           using (PrincipalContext pc = new PrincipalContext(ContextType.Domain, "YOURDOMAIN"))
           {
               // validate the credentials
               return pc.ValidateCredentials(user.UserName, password)
                   ? Task.FromResult(BackOfficeUserPasswordCheckerResult.ValidCredentials)
                   : Task.FromResult(BackOfficeUserPasswordCheckerResult.InvalidCredentials);
           }
       }
   }
   
   
   public void ConfigureServices(IServiceCollection services)
       {
           services.AddUmbraco(_env, _config)
               .AddBackOffice()
               .AddWebsite()
               .AddComposers()
               .Build();
   
   
       services.AddUnique&lt;IBackOfficeUserPasswordChecker, MyPasswordChecker&gt;();
   }
   
   
   

I haven't, as we actually prefer it work this way so we have fine control and whitelist who can login. I'm not familiar with how to completely replace the login process to get around needing Umbraco Users, maybe the OpenID Connect feature could be of use?

is working on a reply...