MDI sensors required on ADFS WAP servers?

[Joachim83]

Hi

Is the MDI sensor required on the ADFS WAP servers, or will installing them on the regular ADFS servers be sufficient?

Our WAP servers are not domain joined, so not sure how that would work with the Directory Service accounts, on the regular ADFS servers the agent would not start until it had access to the gMSA account.

[#2 · Accepted solution]

No you do not need to install it the WAP servers

[#3]

@bjarneabraham  And exactly why not? I mean, activity on the WAP may not reach ADFS, hence you miss these signals of possible malicious actions.

[#4]

One do not install MDI sensors on servers that does not hand out keys to the kingdom.

[#5]

I don't agree. If somebody is knocking at the front door I would like to know. I am not only protecting the fridge 😉 (Zero trust, you know)