Sizing Azure ATP Sensor vs ATA Lightweight Gateway

[Matteo-B]

Hello everyone,

we are implementing Azure ATP on many customers and we're seeing a common pattern on which we have some doubts: by running the Sizing Tool (we downloaded the latest version here https://gallery.technet.microsoft.com/Azure-Advanced-Threat-a11343c4), two Excel sheets are created, one for the recommended resources for ATP and one for ATA.

In every environment we ran the tool (at least three big enterprise environments) we saw that ATA demands way less resources than ATP. From the documentation and other users' experiences online, we understood that ATP Sensor should demand less resources than the ATA Lightweight Gateway, so how is it possible to have such results?

Here some examples with the same servers:

ATA

Server1	Yes
Server2	Yes
Server3	Yes
Server4	Yes, but additional resources required: +1GB
Server5	Yes
Server6	Yes
Server7	Yes
Server8	Yes
Server9	Yes

ATP

Server1	Yes, but additional resources required: +1GB
Server2	Yes
Server3	Yes
Server4	Yes, but additional resources required: +4GB
Server5	Yes
Server6	Yes, but additional resources required: +1GB
Server7	Yes, but additional resources required: +1GB
Server8	Yes, but additional resources required: +1GB
Server9	Yes, but additional resources required: +1GB

Thank you very much.

Best Regards

[#2 · Accepted solution]

Hi @Matteo-B, 

For low traffic domain controllers, the Sensor will require more resources than the ATA Lightweight Gateway. 

I would try the sensor on the servers that the tool is saying they need an additional 1GB of memory. The majority of the time the Sensor will be able to handle the load just fine. 

Thanks