[Bug / Issue]: ARC Extension dashboard for MDE and AMA agent compliance is incorrect

### Issue Type

- [ ] Issue with a Drop I contributed
- [x] Issue with a Drop I am using
- [ ] Issue with the Jumpstart Drops website experience (e.g. broken links, typos)
- [ ] I am not sure

### What happened?

Hi Team,
I have recently onboarded this dashboard. Everything works well and all data points shown match the description. However, the MDE and Azure Monitor Agent (AMA) compliance sections are showing incorrect results.
The dashboard reports that 9–12 servers are missing AMA or MDE, but in reality, those servers do have both AMA and MDE installed.

**Important Note**

If I assign the user account permissions only to access Azure Arc resources, the dashboard works perfectly — the MDE and AMA compliance shows 100% accurate data.
The issue appears only when the user has permissions to query both Azure Arc and Azure VMs. In that case, the dashboard starts showing incorrect compliance data.
Kindly check and advise — this seems like a filtering or resource‑scope evaluation issue when both resource types are included.

### We need a URL

https://github.com/Azure/arc_jumpstart_drops/tree/main/ui_dashboard_workbook/arc_pbi_dashboard

### Relevant log output.

```shell

```

### Code of Conduct and Licensing

- [x] I agree to follow this project's Code of Conduct and Licensing terms.

Start in ui_dashboard_workbook/arc_pbi_dashboard and inspect how the dashboard evaluates AMA and MDE compliance when Azure Arc resources and Azure VMs are both in scope. Compare the queries or filters used with Arc-only permissions against combined permissions. Done means the compliance results remain accurate in both permission scenarios, including the reported servers.

Written by the indexing model from the issue text.