Begin by evaluating the legitimacy of the identified suspicious security principal:

If the Entra tenant is not hybrid (i.e. not synchronized with Active Directory), this role should not be assigned. The reported security principal is either a leftover if the tenant was hybrid at some point, or illegitimate.
Is this a security principal of User type? There are no legitimate cases where a Service Principal or a Group has this role assigned.
When was this security principal created? Does the date actually correspond to the day of the directory synchronization setup with "Microsoft Entra Connect" or "Microsoft Entra Cloud Sync"?
In audit logs: does this security principal regularly perform directory synchronization tasks such as user update, creation, deletion, password change, etc.?
In sign-in logs: does this security principal regularly authenticate from IP addresses that likely belong to your organization?
If you use Microsoft Entra Connect, does its User Principal Name actually contain the name of the expected on-premises Microsoft Entra Connect server? (For example, if the server is called "AADCONNECT", then you can expect this UPN: "Sync_AADCONNECT_@..."). Does it have the expected Display Name "On-Premises Directory Synchronization Service Account"?

If you suspect a breach:

Perform a forensic investigation to confirm the alleged attack, identify the time and author of the attack, and assess the extent of the potential intrusion.
Review the audit logs to identify the potential malicious actions.

Neither the "Directory Synchronization Accounts" role nor its assignees are visible in the Azure portal. To view them, you must use other methods such as the Microsoft Graph PowerShell cmdlets or the API directly:

Connect-MgGraph -Scopes "RoleManagement.Read.All"
Get-MgDirectoryRoleMember -DirectoryRoleId (Get-MgDirectoryRole -Filter "RoleTemplateId eq 'd29b2b05-8046-44ba-8758-1e26182fcf32'").Id | Format-List *

Or alternatively using the now deprecated Azure AD PowerShell cmdlets:

Connect-AzureAD
Get-AzureADDirectoryRole -Filter "RoleTemplateId eq 'd29b2b05-8046-44ba-8758-1e26182fcf32'" | Get-AzureADDirectoryRoleMember

Finally, if the identified security principal does not have a legitimate reason to have this assigned role, and Microsoft Entra Connect or Microsoft Entra Cloud Sync does not use it, you should remove this role assignment. You can do this either with the Remove-AzureADDirectoryRoleMember Azure AD PowerShell cmdlet, or the Remove-MgDirectoryRoleMemberByRef Microsoft Graph PowerShell cmdlet.

Detections

Analytics

Indicators of Exposure

HIGH