Azure AD Connect - Malicious replication of directory services

Hi   Just implemented ATA and the first alert I got was from the MSOL account Azure AD Connect creates from the server it is running on. Is this to be expected?   Thanks T