MicrosoftYour screenshot showing adding the GMSA account seems to be missing the $ the docs state to use when adding a GMSA account to the portal?
https://learn.microsoft.com/en-us/defender-for-identity/deploy/create-directory-service-account-gmsa#configure-a-directory-service-account-in-microsoft-defender-xdr
You should also add you must ensure you give the GMSA Account read permissions to the AD Recycle bin as outlined here - https://learn.microsoft.com/en-us/defender-for-identity/deploy/create-directory-service-account-gmsa#grant-required-dsa-permissions
In my script i had $ - but i found that i had less errors when using DefenderForIdentity powershell module if it did not. When creating everything manually and using the learn-docs, the script present there to set the permissions etc, then $ was required for me (i had to manually add that to this script then https://learn.microsoft.com/en-us/defender-for-identity/deploy/create-directory-service-account-gmsa#grant-required-dsa-permissions) . Therefor i added it in my own script.
But in 3 tenants the last few weeks ive had no issues at all going without it, so im going without it :) (it follows the tenants namingconvention better).
Is there any other reasons to have the $ ? perhaps when adding accounts to logonasservice acl it can be hard to find it without $
