> If users are using microsoft authentication for access, the accounts will be flagged and locked out, generally forcing users to fully authenticate with MFA and forcing a password change.

Last i heard the "state actors" had access to AD master credentials.