The Azure Connected Machine Agent (Arc Agent) works with the Azure Monitor Agent (AMA) to get data into Microsoft Sentinel, but the AMA is the primary agent for log collection, using the Arc Agent to extend Azure management to hybrid machines; they aren't the same, but complementary. The Arc Agent connects servers (on-prem, other clouds) to Azure as if they were Azure VMs, then the AMA (installed as an extension) collects security logs (like Syslog/Windows Events) from these Arc-enabled machines and sends them to Sentinel.
How They Work Together for Sentinel:
Azure Connected Machine Agent (Arc Agent): Installs on non-Azure servers (Windows/Linux) to bring them under Azure management (Azure Arc).
Azure Monitor Agent (AMA): Installed as an extension on these Arc-enabled servers (or Azure VMs).
Data Collection Rules (DCRs): You define DCRs to tell the AMA what logs (e.g., Syslog, Windows Security Events) to collect from the servers.
Microsoft Sentinel: The collected logs are sent to Azure Monitor and then to your Sentinel workspace for threat detection and analysis.
So, the Arc Agent makes your server "Azure-ready," and the AMA collects the security data from that server for Sentinel.
Reference:
https://learn.microsoft.com/en-us/azure/azure-arc/servers/overview