Your network contains an Active Directory Domain Service (AD DS) domain named contoso.com. The domain contains three domain controllers named DC1, DC2, and DC3.

You connect a Microsoft Defender or identity instances to the domain.

You need to onboard all the domain controllers to Defender for identity.

What should you run the domain controllers?