Skip to content

Commit e964bea

Browse files
Update extend-sentinel-across-workspaces-tenants.md
reverting back to 20, which is the actual limit. Adding best practice perf tip. ------- cc: @yelevin
1 parent a182722 commit e964bea

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

articles/sentinel/extend-sentinel-across-workspaces-tenants.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,7 @@ You can then write a query across both workspaces by beginning with `unionSecuri
8888
<!-- Bookmark added for backward compatibility with old heading -->
8989
You can now include cross-workspace queries in scheduled analytics rules. You can use cross-workspace analytics rules in a central SOC, and across tenants (using Azure Lighthouse), suitable for MSSPs. Note these limitations:
9090

91-
- You can include **up to 100 workspaces** in a single query.
91+
- You can include **up to 20 workspaces** in a single query. For good performance though, we recommend keeping it under 5.
9292
- You must deploy Microsoft Sentinel **on every workspace** referenced in the query.
9393
- Alerts generated by a cross-workspace analytics rule, and the incidents created from them, exist **only in the workspace where the rule was defined**. The alerts won't be displayed in any of the other workspaces referenced in the query.
9494

0 commit comments

Comments
 (0)