Azure Sentinel MSP - Non-Scheduled Alert Queries

What is the best approach to take to pull alerts/incidents from non-scheduled rule queries, such as Azure AD Identity Protection) into the MSSP Tenant? Should it be done by using cross-workspace q...