Azure AD Connect - Malicious replication of directory services

[Trent]

Hi

Just implemented ATA and the first alert I got was from the MSOL account Azure AD Connect creates from the server it is running on. Is this to be expected?

Thanks

T

[#2]

are you expecting Azure AD connect to run on that box?  if yes, then exlude the machine from that detection.

[#3]

Yes Azure AD Connect is on that machine.

[#4]

Then exclude it.

[#5]

Hello, please exclude the AAD connect server from the detection. Seyfallah Tagrerout Microsoft MVP

[#6]

Hi, did you manage how to solve that without exclude the alert from such server?

[#7]

@Petr Vlk no, I had to use an exclude

[#8]

I too had this same issue and was curious what to do. Thanks for the post