For recent versions of sssd, the monitor (the sssd.service) won’t even start unless at least one domain is configured.
As sssd.conf(5) notes, all sssd services can be socket-activated when needed. There is no need to list any services in the "services" parameter in [sssd].
So, this leads to a question: if all configured services are configured via systemd to start via socket activation… then what is the monitor actually monitoring? In this configuration, what does it actually do? And is there any reason to even run the monitor at all?
If the answer is, “the monitor performs necessary housekeeping functions so it should be running even if all services are socket-activated,” then shouldn’t it be the case that the monitor should run even if no domains are configured?