Ok, since Windows 10 1607+ and Windows Server 2016+ it changed. SAMR is now restricted to the built-in administrators group. So, if you want to see the "lateral movement paths" in Microsoft 365, you need to configure the Directory Service Account to access the SAM remotely using RPC on every server. It doesn't apply to DC's as every authenticated user can still access the SAM remotely due to compatibility.
"The default security descriptor on computers beginning with Windows 10 version 1607 and Windows Server 2016 allows only the local (built-in) Administrators group remote access to SAM on non-domain controllers, and allows Everyone access on domain controllers"
Source;
https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/networ...I guess that changing the policy where the security descriptor "Administrators" is already added and adding the Directory Service Account isn't impacted at all on Windows 10 1607+ and Windows Server 2016+. it does affect older version of Windows though, but then you can use auditing described in the following link:
https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/networ...Monitor for a few weeks, check if any audits are saved and make the decision if it impacts the server for pre-Windows 10 1607 and Windows Server 2016.
Hope this helps!