Security Copilot Agents in Intune

What it is

Security Copilot agents in Intune are AI assistants, built on Microsoft Security Copilot, that handle a focused task in the Intune admin center. They observe, reason and propose actions, and an administrator reviews and approves the result. The exam objectives for 27 October 2026 add three skills here: investigating threats that agents identify, analyzing device performance with agents, and reviewing and responding to agent recommendations.

How it works

Documented agents

Microsoft's documentation for agents performing broad device performance analysis is not published in the product pages I could verify. Device performance insight is available today through Endpoint analytics (next page) and through Copilot in Intune. Read the current Microsoft Learn pages when you prepare, because the exam objective list is ahead of the documentation.

Prerequisites

• Security compute units (SCUs) provisioned for Microsoft Security Copilot. SCUs are billed even when no agent runs.
• Licenses: Microsoft Intune Plan 1, and depending on the agent, Defender Vulnerability Management (included in Defender for Endpoint Plan 2, or standalone) and Microsoft Entra ID P2.
• Security Copilot enabled in the tenant, with the plugins the agent needs (the Intune plugin for all, plus Defender for the vulnerability agent).
• A supported cloud: public cloud, not government clouds.
• The least privileged role for the agent. Setup commonly needs Security Copilot owner and Intune and Defender read roles, while using an agent needs Security Copilot contributor and read access. Taking an action, such as disabling devices for offboarding, needs the specific permission for that action.
• Agents run under an agent identity. For the vulnerability agent, you grant the identity its permissions in the Entra and Defender admin centers after setup, and use Run readiness check to confirm. Until you do, runs are disabled.
• Setup is in the Intune admin center: Agents, select the agent, View details, then set it up and start it. An admin starts a run manually. For some agents there is no way to stop or pause after it starts.

Reviewing and responding to recommendations

Agents suggest, they do not decide.

1. Open Agents, then the agent, and read the suggestions list, which shows the recommended action, the item and the rationale.
2. Check the supporting detail: the factors the agent used, the affected devices and the risk.
3. Apply the suggestion, dismiss it, or take a different action. For offboarding, the admin approves the batch before devices are disabled or removed.
4. Record the decision. Intune audit logs show the actions, and the Security Copilot portal holds the session details, visible only to the user who set up the agent.

Good practice is to treat output as advice: verify against the device or the source, apply to a pilot first and keep human approval for destructive steps such as offboarding.

Investigating threats surfaced by agents

For the Vulnerability Remediation Agent, the output is a prioritised list of vulnerable software on managed devices. To investigate:

• Open the suggestion for the affected application and the devices with it.
• Move to the Microsoft Defender portal for the device page, vulnerability details and any incident tied to exploitation.
• Use Intune to remediate: deploy an updated app, run a remediation, or restrict the device through a compliance policy and Conditional Access.

Copilot in Intune (not an agent)

Separate from the agents, Security Copilot in Intune answers questions in the admin center. It can tell you a device's properties, enrollment date, primary user and compliance status, link to the device in Defender, help write KQL for device query (for example the processes using the most memory), compare policies and explain settings.

A worked scenario

A company has Security Copilot SCUs and Defender Vulnerability Management. The admin sets up the Vulnerability Remediation Agent, grants its agent identity the required permissions, and runs the readiness check. The agent lists the five applications with the highest risk. She opens each in Defender to check exploitation, then deploys updated packages to a pilot group first. A second agent, the Device Offboarding Agent, proposes 140 stale devices, and she approves only the ones that have not checked in for six months.