Manage and Monitor Security Posture · Topic 3 of 3
Implementing Microsoft Security Copilot
SC-500 Security Copilot: setting up workspaces and capacity, roles and permissions, enabling plugins, and configuring Microsoft and Security Store agents.
- 4 min
- Capacity is provisioned in security compute units (SCUs).
- Workspaces hold sessions, plugins and settings; organizations can have more than one.
- Copilot owner manages settings and plugins; Copilot contributor uses Copilot.
What it is
Microsoft Security Copilot is a generative AI assistant for security teams. It helps summarize incidents, analyze scripts and logs, write queries and guide investigations. It works through plugins that connect it to Microsoft and third-party tools, and agents that perform tasks on their own. SC-500 covers setting it up: workspaces, permissions, plugins and agents.
How it works
Workspaces and capacity
- Security Copilot runs on capacity measured in security compute units (SCUs). A capacity created in Azure has provisioned SCUs (billed hourly) and optional overage SCUs (billed only when used). Microsoft 365 E5 and E7 tenants also receive an included monthly SCU allocation.
- A workspace is where prompts, sessions, plugins and settings live. Organizations can use more than one workspace, for example to separate teams or regions. Each workspace needs its own capacity; SCUs can't be shared between workspaces.
- Admins choose settings such as data sharing options and where data is stored.
Permissions and roles
| Role | Can |
|---|---|
| Copilot owner | Manage settings, capacity, data sharing options, plugin availability for the organization and role assignments |
| Copilot contributor | Use Security Copilot: create sessions, run promptbooks and use the plugins available to them; by default can't manage custom plugins |
These are Security Copilot roles, not Microsoft Entra roles, and they grant no data access by themselves. Entra roles such as Global Administrator and Security Administrator automatically inherit Copilot owner. Assign roles to role-assignable groups. Access to data still depends on the user's own permissions in the connected tools. For example, a user without access to Microsoft Sentinel cannot read Sentinel data through Copilot, so Microsoft Entra roles and the underlying product roles still matter.
Plugins
| Plugin type | Examples |
|---|---|
| Microsoft plugins | Microsoft Defender XDR, Microsoft Sentinel, Microsoft Intune, Microsoft Entra, Microsoft Purview |
| Non-Microsoft plugins | Third-party security products and services |
| Custom plugins | Your own, built with KQL, an API (OpenAPI) or GPT-based instructions |
Owners decide which preinstalled plugins are available and whether contributors can add or publish custom plugins. Some plugins need per-user setup, such as a workspace ID or API key.
Agents
Security Copilot agents run specific tasks, such as triaging phishing reports, recommending Conditional Access improvements or prioritizing vulnerabilities. Agents come from Microsoft and from partners through the Security Store. Enabling an agent includes choosing the identity it runs as (Microsoft recommends a dedicated agent identity over an existing user account), its permissions and its trigger, such as a schedule, and reviewing its results. A partner agent that needs permissions to Microsoft products, such as Defender or Entra, must be approved by a Global Administrator first.
A worked example: a SOC wants AI help with incident summaries and phishing triage. An admin provisions SCUs, sets up the workspace, makes SOC leads Copilot owners and analysts contributors, turns on the Defender XDR and Sentinel plugins, adds a custom KQL plugin for an internal table, and enables the phishing triage agent with a least-privilege identity.
If a user cannot see data from a product in Security Copilot, check their permissions in that product first. Copilot does not grant access to data.
How the exam asks about this
- "Who can manage plugins for the whole organization?" A Copilot owner.
- "Let Copilot query an internal log table." A custom plugin, for example based on KQL.
- "Copilot sessions are slow or blocked for capacity." Review the provisioned security compute units.
What to remember for the exam
- Capacity is provisioned in security compute units (SCUs).
- Workspaces hold sessions, plugins and settings; organizations can have more than one.
- Copilot owner manages settings and plugins; Copilot contributor uses Copilot.
- Plugins: Microsoft, non-Microsoft and custom (KQL, API, GPT).
- Agents automate tasks; enable them with a least-privilege identity and review results.
- Users only see data they already have access to in the connected tools.
Giving everyone the owner role lets anyone change organization-wide plugins and settings. Keep owners few.
Common mistakes
Expecting Copilot to bypass product permissions. It uses the user's own access.
Forgetting capacity. Without SCUs, Copilot cannot run.
Turning on every plugin. Enable only those the team needs.
Check yourself
In what unit is Security Copilot capacity provisioned?
Security compute units (SCUs).
What is the difference between a Copilot owner and a Copilot contributor?
Owners manage settings, plugins and roles for the organization; contributors use Copilot.
Name the three kinds of plugins Security Copilot supports.
Microsoft plugins, non-Microsoft plugins and custom plugins.
Topic 3 of 3 in Manage and Monitor Security Posture
Test yourself on Manage and Monitor Security Posture
The full Microsoft SC-500 question bank has 650 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.