Azure Arc, AWS Linux Host, Defender for Endpoint

Hello,

I wish to join the ranks of confused with licensing!  In a POC we've used Azure Arc to deploy the Connected Machine Agent to a Linux host in AWS.  We've then manually run the MDE onboarding script for Linux.  This worked for the first few machines but than ran into an error:

mdatp health --field org_id
ATTENTION: No license found. Contact your administrator for help.
unavailable.

 Which licence are they referring to?

The client has licences shown in Settings\Endpoints\Licences (P1 and P2) but not how many have been assigned.  The client is showing Defender for Server in Azure AD licences but none have been assigned?

So my question is if you connect servers to azure with azure arc and you want to also deploy Endpoint Protection what is the recommended route?  Enabling Defender for Cloud in Azure to enable a CWP?

Or??

TIA

Rob