Merge pull request #231348 from yelevin/docs-editor/extend-sentinel-across-workspa-1679320204

Update extend-sentinel-across-workspaces-tenants.md

Author: prmerger-automator[bot]

articles/sentinel/extend-sentinel-across-workspaces-tenants.md

@@ -84,12 +84,13 @@ You can then write a query across both workspaces by beginning with `unionSecuri
 
 #### Cross-workspace analytics rules<a name="scheduled-alerts"></a>
 <!-- Bookmark added for backward compatibility with old heading -->
-You can now include cross-workspace queries in scheduled analytics rules. You can use cross-workspace analytics rules in a central SOC, and across tenants (using Azure Lighthouse), suitable for MSSPs. Note these limitations:
+You can now include cross-workspace queries in scheduled analytics rules. You can use cross-workspace analytics rules in a central SOC, and across tenants (using Azure Lighthouse), suitable for MSSPs. This use is subject to the following limitations:
 
-- You can include **up to 20 workspaces** in a single query. For good performance though, we recommend keeping it under 5.
-- You must deploy Microsoft Sentinel **on every workspace** referenced in the query.
+- You can include **up to 20 workspaces** in a single query. However, for good performance, we recommend including no more than 5.
+- - You must deploy Microsoft Sentinel **on every workspace** referenced in the query.
 - Alerts generated by a cross-workspace analytics rule, and the incidents created from them, exist **only in the workspace where the rule was defined**. The alerts won't be displayed in any of the other workspaces referenced in the query.
-
+- A cross-workspace analytics rule, like any analytics rule, will continue running even if the user who created the rule loses access to workspaces referenced in the rule's query.
+   
 Alerts and incidents created by cross-workspace analytics rules contain all the related entities, including those from all the referenced workspaces and the "home" workspace (where the rule was defined). This way, analysts get a full picture of alerts and incidents.
 
 > [!NOTE]
@@ -135,3 +136,5 @@ In this article, you learned how Microsoft Sentinel's capabilities can be extend
 
 - Learn how to [work with multiple tenants](./multiple-tenants-service-providers.md) in Microsoft Sentinel, using Azure Lighthouse.
 - Learn how to [view and manage incidents in multiple workspaces](./multiple-workspace-view.md) seamlessly.
+
+