To enable Azure Security Center vulnerability scanning for ten on-premises Windows Server 2019 machines, which agent should be installed on the servers first?

The Azure Arc enabled servers Connected Machine agent is required to onboard on-premises Windows Server 2019 machines to Azure Arc. Once connected via Azure Arc, Azure Security Center (now Microsoft Defender for Cloud) can discover these machines and enable vulnerability scanning through its integrated solutions like Microsoft Defender for Servers. The Microsoft Defender for Endpoint agent provides endpoint detection and response but doesn't directly enable Azure Security Center's vulnerability assessment for Arc-enabled servers. The Security Events data connector in Azure Sentinel is for collecting security logs, not for enabling vulnerability scanning. The Microsoft Endpoint Configuration Manager client is for on-premises device management and software deployment, not for integrating with Azure Security Center for vulnerability management.