You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: unified-secops-platform/mto-advanced-hunting.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -49,7 +49,7 @@ You can run any query that you already have access to in the multitenant managem
49
49
50
50
:::image type="content" source="media/mto-advanced-hunting/mto-cross-tenants-sidepane.png" alt-text="Screenshot of the Microsoft Defender XDR cross tenants advanced hunting query side pane scope" lightbox="media/mto-advanced-hunting/mto-cross-tenants-sidepane.png":::
51
51
52
-
When selecting multiple tenants, the query is sent to each tenant separately and the results are then gathered and presented to the user in a single table. For example, this means that for the sample query shown below (`DeviceEvents | take 10`), 10 results are returned from each tenant, and the sum total of results are equal to 10 times the number of tenants that you queried.
52
+
When you select multiple tenants, the query runs independently in each tenant, and the combined results are displayed in a single table. For example, the sample query below (`DeviceEvents | take 10`) returns 10 results per tenant, resulting in a total equal to 10 multiplied by the number of tenants selected.
53
53
54
54
1. When you're done, select **Apply** > **Run query**.
0 commit comments