M365 Defender connector

[rsb47546]

Hi,

Am I right in my understanding that if I have the M365 Defender connector enabled in Sentinel, can I disable the component connectors (MDI, MDE, MDO, MDCA) since M365 defender is already ingesting data on these components too? Please confirm. Thanks.

[#2]

So you want to see only Microsoft 365 connector as 'Connected' not the other component connectors? Am I getting it right?

[#3]

My question is if I really need the other component connectors enabled if I have the M365 Defender connector enabled. Am I not getting duplicate data if I have all of them enabled.

[#4]

I don't think so there will be any duplication because other component connectors only having ingestion in SecurityAlert table.