MSOL account is the subject user for an AD password change

Question

Hi all,

I have a Entra connect AD setup. In this setup, Azure is only a backup server, where it synchronizes the objects from on-prem AD to Azure AD at a regular frequency.

Whenever I change my password, subject username was "ANONYMOUS LOGON". But recently I noticed MSOL_xxxx account in subject username.

Up to my knowledge, even though this MSOL account has high privileges, it was configured to sync objects alone.

I would be much obliged if anyone explain why this happened?

Thanks in advance.

Answer 1

Not sure what you mean by "Azure is only a backup server"

But where are you changing this password , what event logs are you seeing this is and do you have SSPR enabled?

https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-enable-sspr

Answer 2

Hi Andy,

Thanks for the reply.

Yes, I checked the docs and understood that Azure isn't a backup server here, instead Entra connect.

And I learned that when I change my password with the help of on-prem AD, subject user is ANONYMOUS LOGON. And when I change my password with the help of Azure AD, subject user is "MSOL_xxx" (SSPR with password write back).

So, SSPR and password write back is enabled.

Could you confirm whether this is the correct?

ref: https://www.youtube.com/watch?v=LwHUrH82ntU