Remote User Authentication with Active Directory vs. Azure Directory

Question

I am a little confused about the added topological complexities that seem to be advocated when designing remote authentication for Active Directory.

I want to have single-sign on for all computers across all applications for both internal and external users. At first glance, it would make sense to me to just forward the proper ports to my local active directory server.

Then, I could do the following:

1. When my website wants to authenticate a user, the site would just ping my external IP on the proper port and it would work.
2. When someone wants to connect a server or workstation to the network remotely, they would just create a VPN connection.

This seems simple enough. However, it seems like others advocate creating a local active directory server which replicates the directory of the initial one. What is the reason for this?

Also, with Azure Directory, it wants to create a federated services connection with my local active directory server - theoretically, would I just be able to use Azure as my primary directory and have all of my workstations, servers, etc. authenticate using it?