Forum Discussion
Brian_Sutton
Aug 05, 2019Copper Contributor
AD Connect MSOL_ User + Suspected DCSync Attack
We use AD Connect in order to replicate our on premise AD accounts to Azure AD. The replication process is completed under the context of the 'MSOL_xxxxxxxx' user account. The AD Connect applicatio...
Michael Platt
Nov 06, 2020Brass Contributor
I figured this out. You added the exclusion from the alert NOT from the exclusions page.