Possible to Disable ATP Controll over OnPrem Accounts

[chufme]

Is it possible to generally disable ATP to manage OnPrem AD Accounts?

With the move to the O365 Portal we have seen that there is the option to disable/enable accounts in the OnPrem AD which we must prevent. 

Alternativelly. Is there a way to prevent a group of accounts where this feature can be disabled? e.g. all Admin or Breakglass accounts?

Is there an easy way to do this?

[#2]

I think I could solve some Parts of my question....

Action Accounts can be set in the "Settings>Identities>General>Manage action accounts" Section which will then prevent ATP to use the 'local system account'-rights to perform the operations OnPrem.
This will then force ATP to use the defined action accounts ("GMSA") to perform the actions where we can narrow down what the account can do.

But now we are still facing the challenge that a Security Admin in Azure could modify this setting (Radio button) in the Action Account section and by that gain unwanted control over OnPrem resources.
Any proposals to mitigate this?

Thanks for the feedback