We use AD Connect in order to replicate our on premise AD accounts to Azure AD. The replication process is completed under the context of the 'MSOL_xxxxxxxx' user account. The AD Connect application is installed on a member server (i.e. not on a DC). AATP is reporting "Suspected DCSync attack (replication of directory services)" for the MSOL_ user account running on that member server. This appears to be a false positive. Is this a known issue/false positive?

Brian_Sutton Yes it is, you should exclude the account or the machine from this alert for now. (Until we will have some news on this, we are working on a feature around this case, but it will take time to see results ...)

EliOfek How do we do this in MCAS as all ATP exclusions are now greyed out?! The DCSync pre-configured policy doesn't seem to have an exclusion option. How should the AADConnect server be tagged to be excluded from the default Suspected DCSync attack (replication of directory services) policy ?

kristofvm Hi, From your message I am not sure whether it's not available in MCAS or in AATP. you can either change the setting in AATP if the MCAS is disabled or vice versa - but not both. There are some customers who are part of our preview program for AATP alert policies in AATP. Once the preview program is completed we will move the experience to MCAS, but until then you should use the AATP portal for that.

I just found this while searching, in relation to Defender for Identity, and if others do the same I add my response here...You will get this alert, Suspected DCSync attack (replication of directory services), when you start with Microsoft Defender for Identity. To Exclude the Azure AD Connect Server from causing this alert you can go to Settings - Identity - Exclusions by detection rule and add your Azure AD Connect server as an excluded device.

EliOfek How do I exclude this account/machine from this alert? I only see an option to Close the alert or to Suppress it (resumes after 7 days). Thanks!

AD Connect MSOL_ User + Suspected DCSync Attack

Kent Nordström
Copper Contributor
May 08, 2024
I just found this while searching, in relation to Defender for Identity, and if others do the same I add my response here...

You will get this alert, Suspected DCSync attack (replication of directory services), when you start with Microsoft Defender for Identity. To Exclude the Azure AD Connect Server from causing this alert you can go to Settings - Identity - Exclusions by detection rule and add your Azure AD Connect server as an excluded device.
- hib1000
  Copper Contributor
  Jun 27, 2024
  ...is the correct answer! Thanks a lot 🙂
Michael Platt
Brass Contributor
Nov 06, 2020
I figured this out. You added the exclusion from the alert NOT from the exclusions page.
EliOfek
Microsoft
Aug 05, 2019
Brian_Sutton Yes it is, you should exclude the account or the machine from this alert for now.

(Until we will have some news on this, we are working on a feature around this case, but it will take time to see results ...)
- SSingh
  Copper Contributor
  Aug 13, 2024
  Has this been fixed or not yet?
  I am seeing frequent FP alerts in my environment from a particular MSOL_**** account.
- Brian_Sutton
  Copper Contributor
  Aug 05, 2019
  EliOfek How do I exclude this account/machine from this alert? I only see an option to Close the alert or to Suppress it (resumes after 7 days). Thanks!
  - EliOfek
    Microsoft
    Aug 05, 2019
    Brian_Sutton Go to the configuration section , into the exclusions tab.

Forum Discussion

AD Connect MSOL_ User + Suspected DCSync Attack

Share

Resources