Overview

Atlanta, USA

Cloud2BR OSS - Learning Hub

Last updated: 2026-08-04

---

References

• What is Microsoft Security Copilot?
• Get started with Security Copilot
• Security Copilot inclusion for Microsoft 365 E5 (Enterprise 5) and E7 (Enterprise 7)
• Manual onboarding
• Security compute units and capacity
• Manage usage
• Manage plugins
• Security Copilot experiences
• Contact support

Microsoft Security Copilot is an artificial intelligence powered security assistant designed to speed up investigations, triage, and response workflows through natural language and integrated product context.

Why it matters

Security teams face high alert volume, fragmented telemetry, and increasingly complex investigation paths. Security Copilot helps reduce analyst toil by combining guided workflows, product context, and repeatable automation.

How it works

Security Copilot implementation in this hub is organized into four tracks:

1. Foundation: architecture, roles, licensing, and capacity model.
2. Implementation: onboarding path, workspace setup, and product integration.
3. Governance: plugin policy, promptbook standards, and workflow controls.
4. Operations: SCU (Security Compute Unit) monitoring, support, and incident response.

Setup across scenarios

Scenario	Setup emphasis
Microsoft 365 E5 (Enterprise 5) and E7 (Enterprise 7) included tenant	Validate auto-provisioning, assign owners, activate workflows
Non-Microsoft 365 E5 (Enterprise 5) and E7 (Enterprise 7) tenant	Provision capacity manually, configure overage strategy
Defender-heavy security operations center	Prioritize embedded incident and threat triage workflows
Multi-product security platform	Govern plugin scope and role boundaries across products

Get started

1. Identify licensing and onboarding path for your tenant.
2. Configure baseline workspace, ownership, and capacity settings.
3. Pilot high-value workflows with selected analyst groups.
4. Expand with governance controls and measurable usage outcomes.

Business example

A security operations center uses Security Copilot in Microsoft Defender for rapid incident summarization, while identity and endpoint teams use embedded experiences in Microsoft Entra and Microsoft Intune. Capacity, plugin access, and workflow quality are governed centrally, reducing response time and improving consistency across teams.