Microsoft Security Copilot: Workspaces, RBAC, Plugins…

Closing the loop on AI security

Simple explanation

Microsoft Security Copilot is the SOC-side AI assistant — the security engineer’s pair-programming partner for investigations, KQL writing, policy authoring, incident summarisation, threat-intel research, and runbook execution.

It deserves the last SC-500 module for two reasons:

It’s a paid Microsoft service that SOC and security engineering teams are adopting in 2026 — the exam tests configuration and governance, not how to use it day-to-day.
It closes the loop on the AI security story: Domain 3 covered protecting AI workloads from threats; this module covers AI as the security tool. Both halves are now part of the SC-500 security engineer’s remit.

SC-500 expects you to know how to set up workspaces, who can do what (RBAC), how plugins extend Copilot’s data sources, and what Microsoft / Security Store agents do.

Workspaces and Security Compute Units (SCUs)

A Security Copilot workspace holds:

Provisioned capacity — measured in Security Compute Units (SCUs), the consumption unit for Security Copilot work. SCUs are purchased in hourly increments and can be increased/decreased per hour. Most workloads run on small SCU counts (e.g. 1–4 SCU) with bursts.
Plugins enabled — what data sources Security Copilot can query.
Role assignments — who can do what within the workspace.
Session history — past prompt sessions for review and re-use as “prompt books”.

Each tenant has one Security Copilot workspace. Workspaces are provisioned in a chosen region.

Permissions and roles

Security Copilot RBAC is workspace-scoped:

Microsoft Security Copilot RBAC — workspace + product-level layering
Role	What it grants
Security Copilot Owner	Workspace settings (region, SCU capacity), plugin enablement, role assignments, session settings. Typically held by a SOC platform lead or security engineering lead.
Security Copilot Contributor	Use Security Copilot, run prompts, create prompt books, install/configure agents where allowed. Cannot change workspace settings or role assignments.
Role-aware (implicit)	Security Copilot's results respect the calling user's underlying Microsoft Entra and product-level permissions — a user without Defender XDR access won't see XDR data via Copilot, even if Copilot's plugin is enabled. Copilot does NOT escalate the user's effective access.

This role-aware behaviour is a critical SC-500 concept: Security Copilot is not a privilege-escalation surface. A SOC tier-1 analyst can ask Copilot to summarise an incident, but if they don’t have Defender XDR read on the underlying data, Copilot returns no data — same as if they queried the source directly.

Plugins

Plugins extend Security Copilot’s data and action surfaces. Microsoft-published plugins include:

Microsoft Defender XDR — query incidents, alerts, entities, Advanced Hunting
Microsoft Sentinel — query Sentinel workspace, analytics rules, incidents, hunting queries
Microsoft Entra — query users, groups, roles, sign-ins, Conditional Access
Microsoft Intune — query devices, policies, configurations
Microsoft Purview — query DLP, eDiscovery, communication compliance, Insider Risk
Microsoft Defender for Cloud — query recommendations, alerts, attack paths
Microsoft Defender Threat Intelligence — query IOC reputation, threat actor data
Public web — limited search of public web for threat-intel context

Third-party plugins are published in the Microsoft Security Store or built custom via OpenAPI. Custom plugins follow the OpenAPI spec for tools, with authentication via OAuth or API key.

Plugin enablement is per-workspace and (where applicable) per-user — admins can scope which plugins are available to which roles.

Microsoft agents and Security Store agents

Agents in Security Copilot are autonomous task-runners that handle specific recurring scenarios. Two sources:

Microsoft-published agents — examples:
- Phishing Triage agent (Defender for Office 365) — auto-triages reported phishing emails, classifies, applies labels
- Conditional Access Optimisation agent (Entra) — recommends CA policy improvements
- Vulnerability Remediation agent (Defender for Cloud) — recommends remediation steps for specific vulnerabilities
- Threat Intelligence Briefing agent — generates regular threat intel briefings for an org
- Alert Triage agent (Defender XDR) — auto-classifies and tags alerts
Security Store agents — partner-published agents in the Microsoft Security Store, installable per workspace. Cover specialty domains (industry-specific compliance, niche SIEM platforms, etc.).

Agents consume SCUs from the workspace’s capacity, just like interactive prompts. Agent enablement is per-workspace; some agents have additional product-level prerequisites (e.g. Phishing Triage agent requires Defender for Office 365 P2).

The SOC use of Security Copilot in practice

In production SOC work, Security Copilot lands in a few high-leverage places:

Incident scoping — “Summarise this Defender XDR incident, name the entities, and list the next investigative steps.” Copilot reads the incident graph and produces a structured summary an analyst can hand to a tier-2.
KQL writing — “Write me a KQL query that finds users who signed in from an unfamiliar location AND then sent an external email AND then accessed a labelled-sensitive SharePoint site, all within 30 minutes.” Copilot drafts the KQL; analyst reviews and runs.
Threat intel pivots — “Given this file hash, summarise what’s known about it from Defender TI.” Copilot returns the TI summary inline.
Policy authoring — “Draft a Conditional Access policy that requires phishing-resistant MFA + compliant device for the Finance group when accessing Microsoft 365 apps.” Copilot drafts the policy structure; analyst reviews and applies.
Automation via agents — Phishing Triage agent silently auto-triages reported phish; analyst reviews exceptions.

The SC-500 exam expects you to know what Copilot does at this level — not the underlying prompt engineering or model behaviour.

Scenario: Dom enables Security Copilot for Kestrel Cyber Co-op

Kestrel SOC adopts Microsoft Security Copilot to scale its analyst capacity across 30+ client tenants:

Workspace provisioned in Kestrel’s tenant, region AU East. Initial SCU capacity: 4 SCU during business hours, 2 SCU overnight (configurable hourly).
Roles:
- Dom (SOC platform lead): Security Copilot Owner.
- SOC engineers: Security Copilot Contributor.
- SOC tier-1/2 analysts: Security Copilot Contributor.
- Lighthouse-delegated analyst sessions from client tenants pick up Kestrel’s workspace via the analyst’s Kestrel identity.
Plugins enabled: Microsoft Defender XDR, Microsoft Sentinel, Microsoft Entra, Microsoft Defender for Cloud, Microsoft Defender Threat Intelligence, Microsoft Purview, public web.
Agents enabled:
- Phishing Triage agent (Defender for Office 365) — auto-triages user-reported phish across all client tenants.
- Alert Triage agent (Defender XDR) — pre-classifies incoming alerts.
- Threat Intelligence Briefing agent — generates a weekly client-by-client TI brief.
Role-aware tested: a tier-1 analyst with Sentinel Responder + Log Analytics Reader for client A’s tenant can use Security Copilot to query Sentinel for that tenant — but receives “no data” if they ask about client B (where they have no permissions). Confirmed during onboarding.

After 90 days: mean time to incident triage drops 40%; reported-phish triage is fully agent-handled; weekly TI briefs land in client emails without manual analyst time; KQL co-authoring with Copilot becomes the default new-detection workflow.