Microsoft Security Copilot and AI-Assisted Security

radio_button_uncheckedshort_text1. Introduction: From rules-based automation to generative AI

The application of computing to security didn't start with generative models. For decades, detection systems have worked with signatures, rules, reputation lists and correlations defined by experts. Later, machine learning techniques began to identify anomalous patterns in large volumes of telemetry. The most recent transformation has occurred with large-scale language models capable of interpreting questions, summarizing evidence, and producing natural language explanations.

On March 28, 2023, Microsoft introduced the then-Microsoft Security Copilot. The product became generally available on April 1, 2024, and has evolved from a chat-centric experience to a platform that combines prompts, embedded experiences, promptbooks, plugins, and agents. This evolution does not eliminate tools like SIEM, XDR, identity controls or SOC professionals; it creates an assistance layer that helps people navigate and correlate data from these tools.

For the reader, understanding this change means learning to use AI without confusing textual fluency with technical certainty. For society, tools of this type can reduce response time to attacks, democratize specialized knowledge and help smaller organizations deal with a shortage of professionals. The benefit, however, only appears when automation is accompanied by governance, privacy, appropriate permissions and human review.

Chapter Guide Question

How do you use AI that produces answers quickly without allowing a convincing answer to replace evidence, access controls, and professional judgment?

1.1 Why security needs assistance at scale

Modern environments generate alerts from endpoints, identities, emails, applications, networks and clouds. The problem is not just collecting signals, but transforming them into actionable context. Analysts need to reconstruct timelines, identify affected entities, query indicator reputation, interpret scripts, write queries, and communicate conclusions to different audiences. Generative AI can reduce the mechanical effort of these steps and free up time for higher-value decisions.

1.2 Copilot as an amplifier, not as a final authority

The term copilot indicates assistance. The system can suggest, summarize, explain and organize, but it does not have legal responsibility, perfect knowledge or complete understanding of the business. A professional remains responsible for validating evidence, evaluating impact, respecting procedures and authorizing actions. This boundary between algorithmic speed and human responsibility will be revisited throughout the chapter.

radio_button_uncheckedshort_text2. Artificial intelligence fundamentals to understand Security Copilot

2.1 Grounding: connecting the model to relevant information

A general language model does not automatically know tenant alerts, internal policies, or the current state of an incident. Grounding is the process of providing relevant context at the time of the request. In Security Copilot, this context can come from Microsoft product plugins, third-party services, threat intelligence, uploaded files, or organizational knowledge bases. Instead of relying solely on what the model learned during training, the response is based on data retrieved for that task.

2.2 Hallucination and uncertainty

Hallucination is the production of plausible but incorrect, unproven or non-existent content. In security, this may appear as a contrived indicator, an overinterpretation of a script, or a recommendation that ignores environment dependencies. Grounding reduces this risk, but does not eliminate it. Therefore, answers must indicate sources, evidence, limitations and, when possible, level of confidence.

Rule of thumb

Well-written text is not evidence. Confirm data in the alert, incident, log, asset, query, or intelligence source before taking action.

radio_button_uncheckedshort_text3. What is Microsoft Security Copilot

Microsoft Security Copilot is a generative AI-based IT and security solution. Its purpose is to increase the efficiency and capability of defenders by combining natural language, language models, security expertise, global threat intelligence, and the organization's authoritative data. It offers a standalone experience and experiences built into products across the Microsoft portfolio.

The service combines large language models delivered through Azure OpenAI Service with Microsoft's security-specific orchestration, plugins, knowledge connections, and global threat intelligence informed by more than 65 trillion signals each day. In the standalone portal, a person submits natural-language requests through the prompt bar and can receive text, images, or documents; embedded experiences bring selected capabilities directly into products such as Microsoft Defender XDR. Customer information remains scoped to the organization and is protected by enterprise security and compliance controls; it is not used to train the foundation models.

3.1 What the solution seeks to do

• Reduce the time spent reading, correlating and summarizing large volumes of signals.
• Help less experienced professionals perform technical tasks with guidance and context.
• Allow experts to transform repetitive procedures into prompts, promptbooks, or agents.
• Facilitate collaboration through briefs, shareable sessions, and audience-tailored reports.
• Connect investigation, identity, devices, data and threat intelligence in an assisted experience.

3.2 What the solution is not

• Does not replace Microsoft Defender XDR, Microsoft Sentinel, Microsoft Entra, Intune, or Purview; uses these products as sources and work surfaces.
• Does not automatically grant access to data that the user could not query in the originating product.
• It does not guarantee that every answer is correct, complete or up-to-date.
• Does not transfer responsibility for containment, communication, compliance, or operational impact to AI.
• It does not transform every incident into a completely autonomous process; Critical actions require controls and supervision.

Product update

In more recent experiences, agents may be the main gateway; the chat remains available for interactive exploration. For the SC-900, focus on purpose, terminology, prompt processing, integrations, and responsible use.

radio_button_uncheckedshort_text4. How Security Copilot processes a request

Although the internal implementation is sophisticated, the conceptual flow can be understood in seven stages. This view helps answer exam questions and, most importantly, avoids imagining that the model queries all data without control.

1. The user submits a prompt. 2. The orchestrator interprets it, establishes the initial context, selects available capabilities, and builds a plan. 3. Copilot executes that plan to assemble the context required for the answer. 4. Enabled plugins and data sources are analyzed to supply security-specific evidence and insights. 5. The language model combines that evidence and composes a human-readable result. 6. The platform formats and checks the output under Microsoft's responsible AI safeguards. 7. The user receives the response and validates it. A visible process log identifies capabilities and sources used, processing details, and completed safety checks so the analyst can assess provenance.

4.1 Permissions remain the border

Microsoft plugins use on-behalf-of authentication, known as on-behalf-of. This means that the platform queries data using the connected professional's identity and permissions. Having access to Security Copilot is not equivalent to receiving unrestricted access to Defender, Sentinel, Entra, Intune, or Purview. To get results, the user needs a Security Copilot role and the necessary permissions on the data source.

4.2 Iterative process

A session does not have to end on the first response. The analyst may ask for details, restrict the period, change the format, select another source or request comparison with a hypothesis. This progressive interaction is important because real investigations rarely fit into a single question.

radio_button_uncheckedshort_text5. Essential Microsoft Security Copilot Terminology

Common proof trap

Plugin is not just a visual extension. It provides data and/or capabilities that allow you to support and expand what Copilot can do.

radio_button_uncheckedshort_text6. How to Write Effective Prompts

The quality of the prompt directly influences the usefulness of the response. Microsoft's documentation organizes a good prompt into four elements: goal, context, expectations, and source. Not every question needs to mention all four explicitly, but this model is especially useful when the task is critical or complex.

6.1 Goal

State the desired outcome. Verbs such as summarize, compare, explain, identify, prioritize, generate and validate reduce ambiguity. “Review this incident” is generic; “summarize the timeline, identify the three most affected entities and propose next steps” is more accurate.

6.2 Context

Enter the period, business objective, investigation phase and audience. The same incident may require a technical explanation for the SOC, an executive summary for leadership, and a timeline for audit.

6.3 Expectations

Define format, level of detail, restrictions and criteria. Examples: table, numbered list, language for non-technical audiences, separation between facts and hypotheses, inclusion of confidence level and citation of evidence.

6.4 Source

Indicate relevant plugins, products, files or knowledge bases. The source guides the grounding and reduces answers based only on general knowledge.

6.5 Example prompts: from vague to verifiable

6.6 Good prompting practices

• Start with a goal and refine in steps, rather than trying to solve the entire investigation in a single prompt.
• Use concrete identifiers: incident number, user, device, domain, IP address, CVE, and time range.
• Ask for separation between observed evidence, inference, and recommendation.
• Request citations from sources or indication of the data used when the scenario allows.
• Specify the audience and output format.
• Avoid entering unnecessary secrets, credentials, or personal data into the prompt.
• Do not automatically accept generated commands, scripts or queries; review syntax, scope, and impact.
• Provide feedback and rephrase when the response does not meet the objective.

6.7 Promptbooks and standardization

Promptbooks group prompts into a task-oriented sequence, such as phishing investigation, vulnerability analysis, or report preparation. They help codify team procedures, reduce forgotten steps, and create consistency. However, a promptbook should be revised when products, threats, or internal processes change.

Promptbook example

1) summarize incident; 2) extract entities and indicators; 3) check reputation; 4) generate hypotheses; 5) list gaps; 6) propose actions; 7) produce a report for the chosen audience.

radio_button_uncheckedshort_text7. Plugins, data sources and organizational knowledge

Plugins are the mechanism that extends Copilot beyond the language model. They can provide context, query services, seek intelligence, or expose specialized tools. The organization can enable or disable plugins, apply filters, and in some cases, customize settings such as the default Microsoft Sentinel workspace.

7.1 Plugin categories

7.2 Organizational knowledge

Internal policies, response playbooks, procedures, KQL libraries, and historical records represent context that a general model does not have. Security Copilot may use files or knowledge base connections to reference this material. Quality depends on up-to-date, well-organized and user-authorized content.

7.3 On-behalf-of authentication

In Microsoft plugins, the on-behalf-of model preserves the identity context: the query occurs on behalf of the logged in user. Therefore, Copilot should not be treated as a shortcut to bypass RBAC. The user may have a Contributor role in Copilot and still be unable to read a specific incident if they do not have permission on the product that contains the data.

Security principle

Connecting more sources increases context and also expands the governance surface. Enable only necessary integrations, apply least privilege, and review data that may appear in responses.

radio_button_uncheckedshort_text8. Standalone Experience and Embedded Experiences

Security Copilot can be used in a standalone portal and within Microsoft products. The standalone experience favors broad investigations, chat sessions, combined use of plugins, promptbooks and collaboration. Embedded experiences present capabilities in the context of the work already being done, reducing tool change.

8.1 Context does not mean automatic trust

An embedded experience can automatically populate incident, alert, or open policy information. This improves relevance, but the professional must still check the scope. An incident summary may omit events, and a generated query may search for a different time period than necessary.

8.2 Agents

Agents perform goal-oriented, structured, and repeatable tasks. On current platform versions, they may be the recommended starting point. Conceptually, an agent combines instructions, identity, permissions, plugins, triggers, and operational limits. The greater the autonomy, the greater the need for auditing, approvals and review of results.

radio_button_uncheckedshort_text9. Use cases in security operations

9.1 Incident investigation and summary

Copilot can consolidate observed alerts, entities, assets, schedules, and techniques into a narrative. This summary helps with triage and shift handover, but should be compared to the original incident page and alerts. The main value is to reduce initial reading time and highlight relationships worthy of investigation.

9.2 Threat intelligence

Intelligence plugins allow you to query threat actor profiles, malicious infrastructure, analysis reports, and vulnerability publications. Copilot can summarize context, relate indicators and adapt the explanation. The analyst must verify currency, attribution, source reliability, and relevance to the environment.

9.3 Analysis of scripts and files

Upon receiving a suspicious script, Copilot can explain commands, techniques, persistence, network communication, and possible indicators. This capability improves accessibility for those who do not speak the language, but does not replace static analysis, dynamic analysis, sandboxing, endpoint telemetry, or expert review.

9.4 Generation and explanation of KQL queries

Kusto Query Language is used in Microsoft Sentinel and Defender advanced hunting. Copilot can turn a natural language question into a query, explain operators, correct syntax, and suggest variations. Before running, confirm tables, field names, time range, volume queried, and whether the query only reads data or integrates a stream with after-effects.

9.5 Reporting and communication

The same investigation needs different formats. Copilot can create executive summary, technical timeline, action list, communication to users, or draft post-incident report. The professional must remove unnecessary data, adapt tone, confirm facts and follow the formal process of the organization.

9.6 Response and Remediation

The system may suggest containment, further investigation and corrections. Examples include isolate device, reset credential, revoke session, block indicator, or adjust policy. The recommendation should not be executed without verifying impact, authority, dependencies, reversibility, and evidence. In critical environments, changes require approval and a return plan.

9.7 IT operations, policy, lifecycle, and stakeholder support

The same assistance layer can synthesize technical evidence to troubleshoot IT issues, compare a new security policy with existing policies to expose conflicts, guide the creation of groups and access parameters in secure lifecycle workflows, and prepare concise stakeholder reports that cover environment context, open issues, and protective measures in the language expected by the audience. These capabilities increase analyst productivity; they do not remove the need for service owners, reviewers, or approvals.

Recommended default

Copilot proposes -> analyst validates -> responsible authorizes -> tool executes -> team confirms result -> evidence is recorded.

radio_button_uncheckedshort_text10. Activation, capacity, roles and permissions

Onboarding has four parts: identify the customer category, make capacity available when required, configure the default workspace environment, and assign permissions. Eligible Microsoft 365 E5 and E7 tenants receive a seven-day advance notice before Microsoft performs zero-click provisioning and receive included capacity without manual Azure setup. Other customers manually provision Security Compute Units (SCUs) and use provisioned plus overage capacity. Commercial quantities can evolve, so always verify the current offer before implementing it.

10.1 Security Compute Units

SCUs measure the compute power used by standalone and embedded experiences, promptbooks, Microsoft or partner agents, and other capabilities. Provisioned capacity is purchased ahead of time and billed by the hour; overage is consumed and billed on demand and can be capped or unlimited. In the source module's manual model, an organization could provision from 1 to 100 SCUs, with three SCUs and unlimited overage suggested for an introductory exploration. Capacity can be increased or reduced without a long-term commitment, and requests can stop when all available capacity is exhausted.

10.2 Security Copilot roles

10.3 Two layers of authorization

6. Platform access: User needs proper role in Security Copilot. 7. Data access: the user needs roles and permissions in Defender, Sentinel, Entra, Intune, Purview or external service.

10.4 Least privilege

Microsoft recommends using roles with the lowest permission set. Highly privileged global roles should be reserved for situations where no specific role exists. It is preferable to assign access by groups, periodically review members and separate platform administration from daily investigative work.

10.5 Manual provisioning and capacity monitoring

Manual onboarding requires an Azure subscription, at least Azure Owner or Azure Contributor on the resource group, and Security Administrator or a higher role in the tenant. A Microsoft Entra Global Administrator does not automatically receive Azure resource permissions; when appropriate, that administrator can elevate access in the Microsoft Azure portal and then assign the required Azure role. Capacity can be created with the Security Copilot onboarding wizard or through Security Copilot in the Microsoft Azure portal. Both paths collect the workspace name, subscription, resource group, region, capacity name, SCU quantity, and overage choice, then deploy the SCUs as Azure resources in the selected resource group.

Capacity owners can adjust SCUs from either portal and use the usage dashboard to review up to 90 days of consumption by workspace, capacity, plugin, session, and initiator. Filters and export support cost analysis and capacity planning. Included Microsoft 365 E5/E7 capacity follows the current inclusion terms; provisioned and overage capacity follow their respective billing models.

10.6 Workspace environment and data controls

• Each workspace is a tenant-bound work environment and must have its own capacity. Workspaces help map costs to teams and budgets and support geo-specific storage requirements.
• At setup, select capacity and data-storage geography. The source module lists Azure datacenters in the European Union Data Boundary, United Kingdom, United States, Australia and New Zealand, Japan, Canada, and South America.
• Choose whether prompts are evaluated only within the selected geography or may be evaluated elsewhere when needed for availability.
• Tenant-wide owner settings can allow Microsoft Purview to process and retain administrative actions, user actions, and Copilot responses for auditing. Organizations without Microsoft Purview must complete the documented limited setup.
• Per-workspace sharing controls decide whether Microsoft may use human review to validate product performance or improve the security AI model. Opting in does not authorize customer data to train foundation models.
• Per-workspace plugin controls define who may add personal or organization-wide custom plugins, which plugins are available to everyone or owners only, and whether Security Copilot may access Microsoft 365 services. Microsoft Purview plugin use currently depends on that Microsoft 365 access setting.

10.7 Role inheritance and source-product permissions

Copilot owner and Copilot contributor are platform roles, not Microsoft Entra ID roles, and grant no security-data access by themselves. Billing Administrator, Microsoft Entra Compliance Administrator, Global Administrator, Intune Administrator, Security Administrator, Purview Compliance Administrator, Purview Data Governance Administrator, and Purview Organization Management inherit owner access so the service retains administrative coverage. Global Administrators, Security Administrators, and Copilot owners can change workspace role membership. The Recommended Microsoft Security roles group can quickly add eligible Microsoft Entra security-role holders as contributors.

A platform role still does not replace permissions in the connected product. For example, using Microsoft Sentinel incident data can require Microsoft Sentinel Reader, while device, privilege, and policy data from Microsoft Intune can require Intune Endpoint Security Manager. Microsoft plugins generally use the on-behalf-of model, so Copilot acts with the signed-in user's entitlements; some configured plugins use their own authentication parameters. Plugin enablement and configuration are scoped to each workspace.

To memorize on SC-900

License or capacity enables the service; Copilot role enables the use of the platform; role in the source product enables access to data. They are related but different controls.

radio_button_uncheckedshort_text11. Privacy, data protection and responsible AI

Prompts, information retrieved to generate responses, replies, pinned items, and uploaded files may constitute customer data. In addition, the service creates system-generated logs for operation, security, and performance. Administrators need to understand where data is processed and stored, what sharing options are enabled, how auditing is configured, and what organizational policies apply.

11.1 Essential controls

• Apply lower privilege and review roles in Security Copilot and integrated products.
• Activate only required plugins and verify their authentication methods.
• Avoid including secrets, credentials or personal data without operational need.
• Define who can upload files and which documents are appropriate as fonts.
• Monitor capacity, usage, sessions, settings and audit logs.
• Learn about data sharing options and tenant feedback.
• Use applicable retention, classification, and compliance policies.
• Train users to verify responses, sources and impact of actions.

11.2 Principles of Responsible AI

Responsible use involves reliability and security, privacy, inclusion, transparency, accountability and fairness. In practice, this means making it clear that the content was AI-generated, recording human decisions, testing behavior in real-world scenarios, limiting autonomy, protecting data, and offering avenues to contest or correct results.

11.3 Limitations that the professional must recognize

radio_button_uncheckedshort_text12. Integrated practical scenario: compromised account investigation

The Contoso company receives an incident correlating outlier location entry, email forwarding rule creation, and PowerShell execution on a user device. The analyst opens the incident in Microsoft Defender XDR and uses the embedded experience to get a first synthesis.

8. Initial summary: request timeline, affected entities and alerts that support the correlation. 9. Identity: Use the Microsoft Entra plugin to review relevant inputs, risk, devices, and changes. 10. Script: ask for PowerShell explanation, extraction of indicators and observed techniques. 11. Hunting: Generate KQL to find similar execution on other devices and users. 12. Intelligence: Consult reputation of domains, IPs and hashes found. 13. Validation: Compare each statement with alerts, logs, query results, and internal procedures. 14. Response: Propose prioritized actions; obtain authorization to revoke sessions, reset credentials, isolate device, and block indicators. 15. Communication: produce executive summary and technical record, removing unnecessary data and identifying facts, hypotheses and gaps.

Expected Result

Copilot reduces the time to organize and explain information. The analyst preserves control over evidence, hypotheses, decisions and execution of actions.

radio_button_uncheckedshort_text13. Review directed to SC-900

13.1 Conceptual pitfalls

• To think that Copilot accesses all tenant data only because the user has a role on the platform.
• Confuse reasoned answer with guaranteed correct answer.
• Imagine that Security Copilot replaces SIEM or XDR.
• Treat plugin and promptbook as synonyms.
• Consider sufficient vague prompt for a critical investigation.
• Run script or query generated without revision.
• Forgetting that capacity, licensing, Copilot role, and permission at source are different requirements.
• Ignore privacy and classification because the tool is corporate.

radio_button_uncheckedshort_text14. Conclusion

Microsoft Security Copilot represents a major shift in the way professionals interact with security data. It transforms natural language into an interface for investigation, intelligence, queries, explanations, and reporting. Its value is born from the combination of language models with grounding, plugins, authorized fonts and integration into the Microsoft ecosystem.

In my assessment, the solution's greatest contribution is not “automating the analyst” but closing the gap between a technical signal and an understandable decision. This can increase productivity and learning, as long as the organization preserves lower privilege, traceability, data quality, and human validation. The more compelling AI becomes, the more important it is to cultivate the habit of asking: What evidence supports this answer?

radio_button_uncheckedshort_text15. Review questions

1. Which alternative best describes the role of plugins in Microsoft Security Copilot?

• A) Replace the permissions of the integrated products.
• B) Connect Copilot to specialized data and capabilities used in grounding and task execution.
• C) Exclusively store the history of prompts.
• D) Automatically convert any recommendation into action.

2. What are the four elements recommended for an effective prompt?

• A) Model, token, license and tenant.
• B) User, password, session and audit.
• C) Goal, context, expectations and source.
• D) Alert, incident, evidence and asset.

3. A user has the Security Copilot contributor role but is unable to query an incident in Defender XDR. What is the most likely explanation?

• A) Contributor only allows to create plugins.
• B) The Copilot role allows to use the platform, but the user also needs permission in the product containing the incident.
• C) Every incident requires Global Administrator role.
• D) Security Copilot does not integrate with Defender XDR.

4. What is the safest conduct in the face of a containment recommendation generated by Copilot?

• A) Run it immediately because it was supported by plugins.
• B) Copy the recommendation to a script and run it on all assets.
• C) Validate evidence, impact, authority, scope and reversibility before authorizing action.
• D) Ignore all AI-generated recommendations.

Answer key with explanations

1. B. Plugins connect Copilot to fonts and tools. They do not automatically elevate permissions or make the response foolproof.

2. C. Goal, context, expectations, and source help the system understand what to produce, why, in what format, and with what data.

3. B. Access has layers: role on the platform and authorization on the products of origin. The on-behalf-of model preserves user permissions.

4. C. Recommendations should be confronted with operational evidence and controls. Human validation is part of responsible use.

radio_button_uncheckedshort_text16. Quick glossary

radio_button_uncheckedshort_text17. Official references for further study

• Microsoft Learn. Study guide for Exam SC-900: Microsoft Security, Compliance, and Identity Fundamentals.
• Microsoft Learn. Describe Microsoft Security Copilot (training module).
• Microsoft Learn. What is Microsoft Security Copilot?
• Microsoft Learn. Prompting in Microsoft Security Copilot.
• Microsoft Learn. Create effective prompts.
• Microsoft Learn. Use plugins in Microsoft Security Copilot.
• Microsoft Learn. Get started with Microsoft Security Copilot.
• Microsoft Learn. Security Compute Units and capacity.
• Microsoft Learn. Privacy and data security in Microsoft Security Copilot.
• Microsoft Learn. Understand authentication in Microsoft Security Copilot.
• Microsoft Security Blog. Introducing Microsoft Security Copilot, 28 March 2023.
• Microsoft Security Blog. Microsoft Copilot for Security is generally available on April 1, 2024.

Update Note

Content revised August 2026. Features, interfaces, regional availability, licensing, and capacity may change. Consult official documentation before deployment decisions.