Microsoft Sentinel
Cloud and workloadsUse federated data sources in Microsoft Sentinel (Preview)
In brief
The page now labels federated data sources as Preview and adds guidance on query optimization, join strategy, and error handling when joining federated and native tables.
What Defender admins need to know
Administrators using federated tables should review the updated practices to optimize query performance and handle errors.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Use federated data sources in Microsoft Sentinel (Preview)
After setting up federated data connectors, you can access your federated tables through multiple interfaces in Microsoft Sentinel. Federated tables are used in the same way as other data lake tables. This article explains how to view federated tables, query them using KQL (Kusto Query Language), and work with them in Jupyter notebooks.
Best practices
Follow these query optimization, join strategy, and error handling guidelines to get the best performance from federated tables.
Query optimization
Use the following practices to improve federated query performance.
Join strategies
Use thesethe following query performance practices when joining federated and native tables.
- Use appropriate join kinds: Choose
inner,leftouter, orrightouterbased on your needs. - Filter before joining: Reduce the data volume before join operations.
@@ -8,15 +8,15 @@ ms.reviewer: amyhari ms.service: microsoft-sentinel ms.subservice: sentinel-platform ms.topic: how-to-ms.date: 06/12/2026+ms.date: 07/01/2026 ms.collection: ms-security ai-usage: ai-assisted-ms.custom: msecd-doc-authoring-1014+ms.custom: msecd-doc-authoring-1016 #Customer intent: As a security analyst, I want to use federated data sources so that I can query external data alongside my Sentinel security data for comprehensive investigations. --- -# Use federated data sources in Microsoft Sentinel+# Use federated data sources in Microsoft Sentinel (Preview) After setting up federated data connectors, you can access your federated tables through multiple interfaces in Microsoft Sentinel. Federated tables are used in the same way as other data lake tables. This article explains how to view federated tables, query them using KQL (Kusto Query Language), and work with them in Jupyter notebooks. @@ -149,6 +149,8 @@ You can create scheduled Jupyter notebook jobs that utilize federated tables in ## Best practices +Follow these query optimization, join strategy, and error handling guidelines to get the best performance from federated tables.+ ### Query optimization Use the following practices to improve federated query performance.@@ -171,7 +173,7 @@ large_dataset_adls_connector ### Join strategies -Use these practices when joining federated and native tables.+Use the following query performance practices when joining federated and native tables. - **Use appropriate join kinds**: Choose `inner`, `leftouter`, or `rightouter` based on your needs. - **Filter before joining**: Reduce the data volume before join operations.