| Get ready | Onboard & engage | Deliver impact | Extend & optimize | |||
|---|---|---|---|---|---|---|
| Principles of Responsible AI What is Security Copilot? Security Copilot Flight School: What is Security Copilot? | Onboard & engage | Microsoft Learn: Explore use cases of Security Copilot Become a Security Copilot Ninja Get started technical documentation | Deliver impact | GitHub repo for Security Copilot | Extend & optimize | Plugins overview |
Resources by role
Explore our most common roles and scenarios below to better understand how Security Copilot can help you be more efficient and productive in your day-to-day tasks.
Security Operations Center (SOC) analyst
SOC analysts are often faced with the challenges of:
- Complex and fragmented tooling: A typical organization’s security stack is a complex patchwork with insufficient integration. This piecemeal approach creates gaps in security and is inefficient in time and budget.
- Immense data volume: The volume of data across identities, devices, clouds, and apps that must be managed and protected continues to expand the threat landscape for organizations. This volume is challenging to manage and may hide vulnerabilities within the organization.
- Shortage of security expertise: Experienced security talent is difficult to find and train, with one in three cybersecurity jobs sitting vacant. Staff shortages slow response time to security incidents and limit resources to proactive posture management.
Security Copilot helps security analysts:
- Catch what others miss. It enables teams to reason over real-time threat signals and their organization’s data to cut through noise, detect threads before they cause harm, and reinforce security posture. Security Copilot is interoperable with other Microsoft Security products and Microsoft threat intelligence to help teams uncover greater insight.
- Outpace adversaries. It puts critical guidance and context at the security teams’ fingertips so they can respond to incidents in minutes instead of hours or days. Analysts and admins can ask questions in natural language and receive script, KQL, or KeyQL output, saving time for teams.
- Strengthen team expertise. It enables junior staff to perform more advanced capabilities and redirects expert staff to the hardest challenges, thus elevating the proficiency of the entire team. It also enables novice security analysts to complete complex tasks with skills like natural language to Kusto Query Language translation and malicious script analysis.
Key scenarios:
- Incident summarization: Gain context for incidents and improve communication across your organization by leveraging generative AI to swiftly distill complex security alerts into concise, actionable summaries, which then enables quicker response times and streamlined decision-making.
- Guided response: Receive actionable step-by-step guidance for incident response, including directions for triage, investigation, containment, and remediation. Relevant deep links to recommended actions allow for quicker response.
- Reverse engineering of scripts: Eliminate the need to manually reverse engineer malware and enable every analyst to understand the actions executed by attackers. Analyze complex command lines scripts and translate them into natural language with clear explanations.
- Impact analysis: Utilize AI-driven analytics to assess the potential impacts of security incidents, offering insights into affected systems and data to prioritize response efforts effectively.
Resources for SOC analysts:
IT admin
IT admins are often faced with the challenges of:
- Ensuring worker productivity across a vast range of endpoints: Maintaining a consistent, high quality user experience across a diverse array of devices across multiple operating systems and locations is critical but challenging. It needs the ability to proactively diagnose and resolve issues to prevent productivity loss and minimize user experience impact.
- Protecting organizations from increasingly sophisticated cyberattacks: As cybersecurity threats grow, IT admins face the challenge of balance robust device policies and preventative security measures while keeping up with constantly evolving regulations.
- Keeping up with rapidly evolving technology: With the shortage of skilled IT Pros, especially in emerging areas like advanced analytics, cloud management, and AI-driven automation, IT teams are stretch thin with trying to balance the demands of maintaining existing systems while integrating new technologies.
Security Copilot helps IT admins resolve endpoint issues by:
- Enabling IT to accelerate troubleshooting and resolution by consolidating vast amounts of data from multiple sources and applying AI-driven analysis to predict issues and help IT take immediate, informed actions before problems escalate.
- Offering dynamic, context-specific guidance for essential IT tasks, including policy configurations and app risk analysis before approving privileges for apps and update management. By providing deep insights and actionable recommendations, Security Copilot identifies and addresses blind spots, resolves conflicts, and ensures consistent compliance, which reduces manual effort and minimizes errors.
- Seamlessly integrating AI-driven insights and natural language capabilities into IT admins’ existing workflows, allowing them to use conversational commands to get real time guidance and recommendations. This integration also empowers IT admins to perform advanced tasks, while continuously building knowledge and enhancing their skillset through the process.
Key scenarios:
- Assisted troubleshooting: Investigate device and app issues quickly and precisely with Copilot gathering and analyzing data for you.
- Identify policy conflicts: Reduce the risk of operational disruptions and vulnerabilities caused by conflicting or misconfigured policies.
- Drafting KQL queries to get device insights: Use Copilot to construct a KQL query and run the query to get device details from single and multiple devices.
Resources for IT admins:
Identity admin
Identity admins are often faced with the challenges of:
- Overwhelming identity threats requiring complex, time-consuming investigations and expertise: They must troubleshoot and adjust policies in real time while maintaining a balance between security and business continuity.
- Inconsistent IAM policies that increase risk, weaken security, and cause inefficiency: Variations in identity practices, such as unauthorized or undocumented policy adjustments, complicate data correlation, increase the risk of errors, and lead to significant gaps. These inconsistencies reduce operational efficiency and increase exposure to identity-related threads.
- Operational overload limits IAM focus: Identity admins manage billions of identities, each with unique policies and access rights, while defending against AI-driven attacks. This limits their ability to focus on proactive security improvements and IAM optimization.
- Cybersecurity talent shortage heightens risks and strains IAM capacity: A shortage of skilled cybersecurity professionals mean identity admins are stretched thin with managing complex IAM systems. When skilled admins are unavailable, routine tasks can be delayed, leading to potential misconfigurations, inefficient processes, and heightened security risks. This impacts both security and operational continuity.
Security Copilot helps identity admins by:
- Simplifying repetitive IAM tasks to help automate identity management and policy enforcement. Automating routine activities frees up time to focus on high impact tasks, improving overall productivity and reducing human error.
- Helping with AI-driven threat detection, insights, and mitigation. It brings advanced identity contextualization and real time insights to the admins’ fingertips. Natural language summarization brings the most critical context forward, allowing for data-driven decision making.
- Providing natural language insights and contextual recommendations. This empowers admins to make data-driven, precise decisions. It helps bridge skill gaps and supports collaboration and makes complex IAM tasks more manageable for less experienced team members. This enables identity teams to handle sophisticated identity challenges more effectively, opening resources to focus on strategic, high impact issues.
Key scenarios:
- Using Copilot in Entra to protect identities and secure access with AI-driven risk detection and mitigation: Copilot in Entra enables identity admins to significantly reduce investigation and resolution time by automating the most time-consuming aspects of their work. It automates data gathering, correlation, and contextualization, eliminating the need for admins to manually sift through auth logs, review complex policies, or conduct time-intensive investigations. Instead, Copilot provides natural language summaries that clearly explain elevated user risks, delivers actionable insights tailored to each incident, and offers customized recommendations with quick links to relevant documentation.
- Using Copilot in Entra to troubleshoot access failure during critical access attempts: Identity admins no longer need to spend hours reviewing logs and gathering data (e.g., sifting through auth, application, and network logs), identifying root causes (such as MFA failures due to unregistered devices), and implementing the fix (such as re-registering the device or adjusting policies). With Security Copilot, admins can quickly start troubleshooting sign-in events directly in the Entra admin center, with succinct summaries of the most relevant information. Copilot helps admins quickly identify the root causes of sign-in failures, interruptions, MFA prompts, and other issues, providing actionable prompts to investigate and resolve problems efficiently.
- Assisted incident investigation and troubleshooting with Microsoft Entra skills in Security Copilot: Copilot with Entra can enhance the resolution of identity incidents by streamlining the investigation process. It can quickly summarize and contextual critical information (like user roles, sign-logs, and risk factors) to provide analysts with a clear overview of the situation in natural language. This helps analysts understand the scope and specifics of potential compromises, facilitating faster decision-making and response.
Resources for IT admins:
Data security admin
Data security admins are often faced with the challenges of:
- Vast data volume and quantity of alerts. The high volume and complexity of alerts leads to alert fatigue, where critical threats might be missed.
- Incident response time and coordination. Coordinating a timely and effective response to data security incidents requires collaboration across multiple team members and departments. Delays in communication and decision-making can lead to longer resolution times and increased damage.
- Shortage of expertise. There is a well-documented shortage of skilled cybersecurity professionals, which puts pressure on existing teams to manage a growing number of threats with limited resources. This is worsened by organizations many times having limited resources to increase and train teams.
- Visibility risk across data and users. The complexity of diverse data environments, including on-premise systems, cloud, and hybrid infrastructures, combined with dynamic user access patterns, makes it challenging for security admins to maintain comprehensive risk visibility.
Security Copilot helps data security admins by:
-
- Uncovering hidden data risks. It analyzes large volumes of data across different solutions to enable integrated investigations. Discover and manage risks across your data security landscape with Data Security Posture Management (DSPM), and explore insights from Information Protection, Data Loss Prevention (DLP), and Insider Risk Management (IRM) under a single dashboard. DSPM provides Security Copilot-powered recommendations on your organization’s data classification, policies, alerts to be prioritize, users to analyze, and take you further into investigations with open prompt questions.
- Accelerating data security investigations. Security Copilot enables teams to understand cases and identify risks faster by providing contextual summaries with a single click in IRM and DLP, all within the existing investigation workflow. In IRM, it enables concise visibility from content evaluated against relevant policies and simplifies explorations with contextual evidence. In DLP, it speeds policy tuning timing and supports teams to improve data security coverage and discover additional risks.
- Strengthening data security expertise. It can provide actional guidance to upskill your teams, enable more assertive performance, and empower analysts at all levels to conduct advanced investigations. For experienced admins, DSPM centralizes insights across investigations and shows top data security risks, as well as recommendations on how to address, how sensitive the data landscape is, and how data is moving with users. For new admins, DSPM provides aggregated insights and helps them jump start navigating the organization’s landscape.
Key scenarios:
- Uncover, manage and act on hidden risks. With DSPM as a launchpad for data security analysis, admins will be able to paint a broader picture of their data landscape across Information Protection, DLP and IRM under a single pane of glass. DSPM should be where to go at the beginning of each day to understand where to focus and where to get started.
- Analyze incidents deeper and more efficiently. When evaluating alerts, data security admins can perform faster investigations by leveraging Security Copilot to gain more context from incidents, distill complex security alerts into concise, actionable summaries, which enables quicker response times and streamlined decision-making. Moreover, teams can use Copilot-driven analytics to enhanced alert and user investigation in IRM, double clicking into a user’s risk profile, and activities, beyond the alert summary. Users will be able to expand prompts available in DLP beyond the alert summary, such as data/user-specific investigation and prompts and filters in Activity Explorer.
- Discover protection gaps and streamline controls. Data security admins can streamline policy tuning and policy planning, improving coverage and controls, with Copilot-powered DLP policy gap analysis, based on each organization’s data landscape needs and vulnerabilities.
- Expedite data security investigation. Uplevel data security investigations natural language search that doesn’t require query language knowledge, summarization capabilities that accelerate incident exploration and understanding, and interrogation with deep content analysis in DSPM.
- Explore AI-powered guidance to empower teams. Receive actionable guidance through Knowledge Hub to understand your data landscape and better explore the Purview solutions, with relevant deep links to recommended actions and next steps to optimize investigations and workloads.
Resources for data security admins:
Quick links to help you become a Security Copilot expert
Security Copilot for Small and Medium Business
Security Copilot offers small businesses a powerful tool to enhance their security posture and respond to threats more effectively. By leveraging AI, it increases the efficiency and capabilities of security teams, allowing them to detect and mitigate cyber threats swiftly. Integration with the Microsoft security products you’ve already deployed ensures comprehensive coverage across multiple platforms and devices, while the step-by-step guidance empowers both junior and senior staff. Security Copilot helps reduce operational costs by minimizing the need for extensive security personnel and managing vast data volumes efficiently and provides small businesses with a cost-effective, proactive approach to maintaining robust security.
Watch our videos below to get started.
Security Copilot experiences
Security Copilot seamlessly integrates and is natively embedded across Microsoft Security solutions to safeguard your entire organization. It consumes signals from each security tool and provides natural language guidance to increase team efficiency and manage daily security and IT workflows. Security Copilot is not a replacement for these tools; instead, Security Copilot’s generative AI enables security and IT professionals to access, summarize, and act on insights from their tools faster.
Copilot in Defender XDR
Learn moreCopilot in Microsoft Entra
Learn moreCopilot in Microsoft Intune
Learn moreCopilot in Microsoft Purview
Learn moreCopilot in Azure Firewall
Learn moreCopilot in Azure Web Application Firewall
Learn moreCopilot in Microsoft Sentinel
Learn moreCopilot in Defender External Attack Surface Management
Learn moreCopilot in Threat Intelligence
Learn moreCopilot in Defender for Cloud and XSPM
Learn moreJoin the Security Copilot Customer Connection Program (CCP)
Join now to access free technical skilling webinars and participate in private previews. Hear straight from our product engineers and get a sneak peek into the Security Copilot product roadmap. Membership is free and perks are plenty! A valid Microsoft NDA is required to opt-in. Please choose Security Copilot when prompted for which community you want to join.
