You have a Microsoft Sentinel deployment and 100 Azure Arc-enabled on-premises servers. All the Azure Arc-enabled resources are in the same resource group. You need to onboard the servers to…

Azure Automation can be used to run scripts, but configuring and managing automation runbooks for onboarding 100 servers would generally involve more administrative effort than a declarative Azure Policy assignment.

Azure Policy allows you to define, assign, and manage policies across your Azure resources, including Azure Arc-enabled servers, to enforce standards and assess compliance. By creating a policy assignment that automatically deploys the Azure Monitor Agent (or Log Analytics agent for older Sentinel workspaces) to all Azure Arc-enabled servers within the specified resource group, you can ensure they are onboarded to Microsoft Sentinel with minimal manual intervention, adhering to the principle of least administrative effort.

Azure virtual machine extensions are used to deploy agents, but applying them individually to 100 servers or managing them without a policy orchestration tool would not minimize administrative effort effectively.

Microsoft Defender for Cloud provides security posture management and threat protection, and while it might leverage the same agents, it does not primarily handle the mass onboarding of Azure Arc servers to Sentinel for data collection in the most administratively efficient way.