MHO are always active in Single and/or dual Site
SGM are always active in Single and/or dual Site
What is not Active/Active is the security group, it can be active only on one site, the other side is Standby
MHO should be bond and in the bond you can configure if are A/A or A/B
You can connect a SGM to both orchestrator using dual DAC/Backplane it does mean 2 downlinks from SGM to same orchestrator for redundancy
MHO for Security Group works as a bond, then if you lost 1 MHO. for Security Group is link lost 1 interface of the bond, but remain as Active on that side