You have Microsoft Sentinel and 100 on-premises servers connected via Azure Arc, all in one resource group. To onboard those servers into Sentinel with minimal admin effort, which method should you use?

Azure Policy is the most efficient method for onboarding a large number of Azure Arc-enabled servers to Microsoft Sentinel. You can create a policy definition that deploys the Azure Monitor Agent (AMA) to all specified Arc-enabled servers within the resource group. This automates the installation and configuration, ensuring consistent deployment with minimal administrative overhead. Azure Automation could be used, but it would require more scripting and management of runbooks compared to the declarative nature of Azure Policy. Azure virtual machine extensions are the underlying mechanism for deploying agents, but Azure Policy provides the scalable orchestration for deploying these extensions across many machines. Microsoft Defender for Cloud integrates with Sentinel, but its primary role is security posture management and threat protection, not the initial agent deployment for Sentinel data ingestion across a large fleet of servers.