So, I've been using this new 'Secure Score' feature today (fab tool, good idea Microsoft) and as a result of this I've decided to turn on MFA for Admin accounts.
Thing is, the Dir Sync account is a Global Admin, but I can't (can I?) turn on MFA for that account, because surely it would mess it up when it authenticates to push the data up.
So, does the Dir Sync account need to be a Global Admin? Or how do I get around the fact that this account is my weak link because I can't turn on MFA for it?