MEA - Administration Guide, FortiSIEM 6.7.5
To run the FortiSIEM Collector management extension application, the following requirements must be met:
FortiAnalyzer 7.0.1 or above
FortiSIEM Supervisor, Worker, Collectors 6.3.0 or above.
FortiSIEM Linux Agent 6.3.0 or above.
FortiSIEM Windows Agent 4.1.2 or above.

In a Fortinet Security Fabric, logs from downstream devices can be sent to FortiAnalyzer through the root FortiGate. This is why all the logs have the same source IP address (the root FortiGate). The root FortiGate aggregates and forwards the logs from all downstream devices, so the source IP in the log capture will appear to be from the root FortiGate itself, even though the logs originate from multiple devices within the fabric.

A FortiAnalyzer system backup includes configurations, report settings, and system information, but it does not include logs from registered devices or database snapshots. Logs are stored separately and are not part of the system configuration backup.

DOMs with registered devices cannot be deleted.
An ADOM cannot be deleted if it has registered devices. You must first remove or deregister the devices before deleting the ADOM.
The status of the ADOMs must be unlocked.
An ADOM must be in an unlocked state before it can be deleted. If the ADOM is locked, it will not allow deletion.

page 138 of the FortiAnalyzer 7.4 Admin Study Guide. If there is an existing primary device, then this device becomes a secondary device. The default role is Secondary, so that the device can synchronize with the primary device. A secondary device cannot become a primary device unit it is synchronized with the current primary device.