One query, five limits it runs into
Advanced hunting in Microsoft Defender, and the five service limits a single query runs into, from Microsoft's own page.
How far back: 30 days
Each advanced hunting query reaches native Defender XDR data from up to the past 30 days, however far back its own time filter asks. With a Microsoft Sentinel workspace onboarded, its tables reach back as far as their analytics-tier retention, and that is also how supported Defender XDR hunting tables are kept past 30 days. Data stored only in the Microsoft Sentinel data lake isn't in advanced hunting at all. Microsoft's advanced hunting overview
How much: 100,000 rows and 64 MB
Each query returns up to 100,000 rows. Its results also cap at 64 MB, a size set by the number of columns, the data types and the field lengths as well as the row count. Past it, the portal returns what fits and says the results are partial.
How long: 10 minutes
A query that hasn't finished in 10 minutes ends with an error.
How hard: the tenant's CPU
Each tenant gets CPU resources by its size, counted in 15-minute cycles. The portal shows a warning when a query runs while the tenant is past 10% of its allocation. At 100%, queries are blocked until the next cycle. Queries run by hand and custom detection rules each have these limits separately.
Through the Graph API, other numbers
Hunting queries sent through Microsoft Graph have their own limits: a request that runs past three minutes times out and returns an error, and results cap at 50 MB. Microsoft's Graph security API overview
The SC-200 Microsoft Security Operations Analyst Complete Exam Guide carries these limits. The card below links it.
The guide
SC-200 Microsoft Security Operations Analyst Complete Exam Guide
Prepare for Exam SC-200 by learning which plan grants a capability, which portal owns a setting, and which limit decides the answer.