Update mto-advanced-hunting.md

Author: batamig

unified-secops-platform/mto-advanced-hunting.md

@@ -3,18 +3,18 @@ title: Advanced hunting in Microsoft Defender multitenant management
 description: Learn about advanced hunting in Microsoft Defender multitenant management
 search.appverid: met150
 ms.service: unified-secops-platform
-ms.author: deniseb
-author: denisebmsft
+ms.author: bagol
+author: batamig
 ms.localizationpriority: medium
-manager: dansimp
+manager: orspodek
 audience: ITPro
 ms.collection: 
 - m365-security
 - highpri
 - tier1
 - usx-security
 ms.topic: article
-ms.date: 05/02/2025
+ms.date: 07/07/2025
 appliesto:
   - Microsoft Defender XDR
   - Microsoft Sentinel in the Microsoft Defender portal
@@ -23,18 +23,15 @@ appliesto:
 # Advanced hunting in Microsoft Defender multitenant management
 
 Advanced hunting in Microsoft Defender multitenant management allows you to proactively hunt for intrusion attempts and breach activity in email, data, devices, and accounts across multiple tenants and workspaces at the same time. If you have multiple tenants with Microsoft Sentinel workspaces onboarded to the Microsoft Defender portal, search for security information and event management (SIEM) data together with extended detection and response (XDR) data across multiple tenants and workspaces.
- 
 
 Multiple workspaces per tenant are supported in multitenant Advanced hunting as preview.
 
-
 ## Quotas
 
 In multitenant environments, advanced hunting queries can return a maximum of 50,000 records in total. The result set from each individual tenant is capped at 50,000 divided by the number of tenants queried. 
 
 For more information about service limits in advanced hunting, read [Understand advanced hunting quotas](/defender-xdr/advanced-hunting-limits#understand-advanced-hunting-quotas-and-usage-parameters).
 
-
 ## Run cross-tenant queries
 
 You can run any query that you already have access to in the multitenant management **Advanced hunting** page.
@@ -68,11 +65,15 @@ You can run any query that you already have access to in the multitenant managem
    | take 10
    ```
 
+To learn more about advanced hunting in Microsoft Defender XDR, read [Proactively hunt for threats with advanced hunting in Microsoft Defender XDR](/defender-xdr/advanced-hunting-overview).
 
-> [!NOTE]
-> If you have tables with the same name but different schemas in multiple workspaces and want to use them in the same query, you should use the workspace operator to uniquely identify the table that you need.
+### Use adx(x) operator for Azure Data Explorer queries carefully
 
-To learn more about advanced hunting in Microsoft Defender XDR, read [Proactively hunt for threats with advanced hunting in Microsoft Defender XDR](/defender-xdr/advanced-hunting-overview).
+Consider carefully before using the `adx(x)` operator for queries on multiple tenants. Advanced hunting in the multitenant portal sends each query to each of the selected tenants in parallel. The tenants returns the results, which are then aggregated and sent back to the portal. Using the `adx(x)` operator in your queries effectively queries ADX multiple times, once for each tenant, and the returned and aggregated data might include duplicate information.
+
+We recommend using the `adx(x)` operator with multiple tenants only when you want to join results from each tenant with ADX data. 
+
+For more information, see [Use Microsoft Sentinel functions, saved queries, and custom rules](/defender-xdr/advanced-hunting-defender-use-custom-rules#use-adx-operator-for-azure-data-explorer-queries).
 
 ## Run cross-workspace queries
 
@@ -100,16 +101,14 @@ For more information, see [Query multiple workspaces](/azure/sentinel/extend-sen
 
 ## View schema tables
 
-You can view the [advanced hunting schema tables](/defender-xdr/advanced-hunting-schema-tables) in the left pane inside the advanced hunting page under the **Schema** tab. 
+View the [advanced hunting schema tables](/defender-xdr/advanced-hunting-schema-tables) in the left pane inside the advanced hunting page under the **Schema** tab. 
 
 The schema list is a unified view of all tables from all your tenants regardless of the tenant selected in the upper right tenant selector.
 
 This could mean that some tables that appear here might only be available for query in some tenants, like custom Microsoft Sentinel tables.
 
-
 ## View and manage custom detection rules
 
-
 You can also manage custom detection rules from multiple tenants in the custom detection rules page.
 
 ### View custom detection rules by tenant
@@ -138,11 +137,6 @@ To manage detection rules:
 
 1. Select **Open detection rules** to view this rule in a new tab for the specific tenant in the [Microsoft Defender portal](https://security.microsoft.com). To learn more, see [Custom detection rules](/defender-xdr/custom-detection-rules).
 
-
-
-
-
-
 ## Related content
 
 - [Set up Microsoft Defender multitenant management](mto-requirements.md)