Forgot to mention some of the Cons...
The thing I don't like about this, at least from my organization, is integrated authentication. We push to centralize access in AD as much as possible so when the user comes onboard we just add them to the correct groups and when they leave everything is disabled when their AD account is disabled. With localized file/e-mail access through a corporate DFS/CIFS structure, exchange or Sharepoint its tied to their AD Account and is easily managed.
I vaguely remember reading something not to long ago about ADFS2 which would allow simple federated trust relationships with cloud providers.
Having to add more first/last day processes and then provide evidence for SOX that we've followed the process would certainly be a downside.