Correct defender for identity setup in a multidomain enviroment

I'm  setting up a defender for identity in a multi domain enviroment. Lets call the top domain zzz.net with the subdomain xxx.zzz.net The top domain has very few users and computers. The sub domain...