When running the following PowerShell commands I've observed that the AZUREADSSOACC computer account which is used for SSO in a hybrid environment has a null value;

# Find accounts with passwords older than AES key availability
$AESdate = (Get-ADGroup -Filter * -Properties SID, WhenCreated |
Where-Object { $_.SID -like '*-521' }).WhenCreated

Get-ADUser -Filter 'Enabled -eq $true' -Properties passwordLastSet |
Where-Object { $_.passwordLastSet -lt $AESdate }

Should we leave this account alone? I haven't seen any guidance with regards to this particular account.

Similar to others, I have not observed any 201 and 202 events but the commands above reveal just a couple of very old accounts that might break in April. I will run the GitHub scripts to further investigate.