You have an Azure subscription that has Microsoft Defender for Cloud enabled. You have a virtual machine named Server1 that runs Windows Server 2022 and is hosted in Amazon Web Services (AWS). You…

The Microsoft Monitoring Agent (MMA) is a legacy agent primarily used for Log Analytics and Azure Security Center, but for onboarding hybrid machines and leveraging newer Defender for Cloud capabilities, the Azure Connected Machine agent is the foundational step.

The Azure Monitor agent is used for collecting guest OS logs and performance data, but it typically requires the machine to be already managed by Azure (e.g., via Azure Arc for hybrid machines), making the Azure Connected Machine agent the initial installation.

The Azure Connected Machine agent (part of Azure Arc) is required to onboard non-Azure machines (like those in AWS) to Azure, allowing them to be managed as Azure resources, which is a prerequisite for Defender for Cloud to collect logs and provide vulnerability assessments. This agent establishes connectivity to Azure Arc, enabling hybrid management capabilities.

The Azure Pipelines agent is used for running jobs in Azure DevOps pipelines and is unrelated to connecting a server for security management with Defender for Cloud.