diff --git a/modules/nw-networkpolicy-multitenant-isolation.adoc b/modules/nw-networkpolicy-multitenant-isolation.adoc
index 8ab369f009fd..1cd544ef3c58 100644
--- a/modules/nw-networkpolicy-multitenant-isolation.adoc
+++ b/modules/nw-networkpolicy-multitenant-isolation.adoc
@@ -43,13 +43,17 @@ spec:
   - from:
     - namespaceSelector:
         matchLabels:
-          network.openshift.io/policy-group: ingress
+          policy-group.network.openshift.io/ingress="" 
   podSelector: {}
   policyTypes:
   - Ingress
 EOF
 ----
-
++
+[NOTE]
+====
+`policy-group.network.openshift.io/ingress=""` is the preferred namespace selector label for OpenShift SDN. You can use the `network.openshift.io/policy-group: ingress` namespace selector label, but this is a legacy label. 
+====
 .. A policy named `allow-from-openshift-monitoring`:
 +
 [source,terminal]