It feels like either a subordinate, or a primary charm that you deploy to each machine to configure its PAM to integrate with your AD backend.
We have discussed in the past a sort of “machine subordinate”, that defines a charm to deploy on every machine in a model for similar use cases as this. (On all the machines, I want it to run this snippet of code, and do so reasonably early on.)
Putting the ansible code in a charm and installing it would get you there, and give you reasonable ways to upgrade it over time, see that its running, status, etc. I do think ‘global subordinate’ as a way to ensure that it is always available fits your use case pretty well.