Data connectors, the Defender XDR connector and ingestion design
How data gets into Microsoft Sentinel, connector by connector type, what the Defender XDR connector really brings and costs, how DCRs and transformations shape what lands in the workspace, and how to pick a tier per table.
Where Active Directory sits in the whole picture
The tie-together mental model for this knowledge base, AD DS as the on-prem authority, Entra ID as the cloud authority, the sync bridge between them, device join as the fork that decides GPO or Intune, where each Defender product touches AD, what still needs AD in 2026, and the migration arc most clients are on.