Add AD FS Servers As An Exception For AATP?

[AakashShah]

Hello!  We just installed AATP a week ago in our environment and a few days ago, we started to receive alerts from AATP about our AD FS (Active Directory Federation Services) servers reporting "Account enumeration reconnaissance".  The alert looked something like this:

Account enumeration reconnaissance was detected in <tenant>

An actor on <AD FS server> performed suspicious account enumeration exposing <count> existing account names.

Is this normal for the AD FS servers to report this, and if so, is it safe to add this as an exception?  I saw that the AATP console suggested adding the DirSync servers, but I didn't see anything about the AD FS servers, so I wanted to clarify whether this is something we need to further investigate?

Thanks!

[#2]

@AakashShah

ADFS servers are typically open to the Internet  and are therefore a potential target for account enumeration attacks. In this alert, all the users who failed to authenticate to do not exist in Active Directory. We recommend that you check if the users in the list have been removed AD recently, or if the list looks more like a dictionary attack. Once you understand the user list you can determine if the alert is being triggered by a process in your environment which is enumerating the users, or if it is potentially a real attack.