If MDI sensor is installed, is there still a need for AMA?

Hi Stephen32uk,

the Microsoft Defender for Identity (MDI) sensor and Azure Monitor Agent (AMA) serve distinct purposes and can be employed together based on specific requirements.

The MDI sensor is designed for monitoring and managing identity-related threats on servers. It provides details such as sensor name, domain membership, version number, service status, sensor status, health status, and more.

On the other hand, the AMA is utilized to transmit server information to Microsoft Defender for Cloud for analysis. As per the updated Defender for Cloud strategy, AMA is no longer mandatory for Defender for Servers but remains necessary for Defender for SQL Server on machines.

To consolidate all feeds into Sentinel, you might still need AMA installed, especially if Defender for SQL Server is in use on the machines.

Azure Monitor Agent in Defender for Cloud - Microsoft Defender for Cloud | Microsoft Learn