This reference architecture illustrates how to use Microsoft Defender for Cloud and Microsoft Sentinel to monitor the security configuration and telemetry of on-premises and Azure operating system workloads. This includes Azure Stack. Download a Visio file of this architecture.
https://learn.microsoft.com/en-us/azure/architecture/hybrid/hybrid-security-monitoring