M365 Defender connector

Question

Hi,
&nbsp;
Am I right in my understanding that if I have the M365 Defender connector enabled in Sentinel, can I disable the component connectors (MDI, MDE, MDO, MDCA) since M365 defender is already ingesting data on these components too? Please confirm. Thanks.

usama_saleem · Answer

So you want to see only Microsoft 365 connector as 'Connected' not the other component connectors? Am I getting it right?

rsb47546 · Answer

My question is if I really need the other component connectors enabled if I have the M365 Defender connector enabled. Am I not getting duplicate data if I have all of them enabled.

usama_saleem · Answer

I don't think so there will be any duplication because other component connectors only having ingestion in SecurityAlert table.

Forum Discussion

M365 Defender connector

3 Replies