Forum Discussion
AD Connect MSOL_ User + Suspected DCSync Attack
We use AD Connect in order to replicate our on premise AD accounts to Azure AD. The replication process is completed under the context of the 'MSOL_xxxxxxxx' user account. The AD Connect applicatio...
EliOfek
Microsoft
MicrosoftBrian_Sutton Yes it is, you should exclude the account or the machine from this alert for now.
(Until we will have some news on this, we are working on a feature around this case, but it will take time to see results ...)