Agentic security your way: Build your own Security Copilot agents

Agentic security your way: Build your own Security Copilot agents

This post was originally published on this site.


Microsoft Security Copilot is redefining how security and IT teams operate. Today at Microsoft Secure, we’re unveiling powerful updates that put genAI and agent-driven automation at the center of modern defense. In a world where threats move faster than ever, alerts pile up, and resources stay tight, Security Copilot delivers the competitive edge: contextual intelligence, a growing network of agents, and the flexibility to build your own. 

The announcements focus on three key areas: building your own Security Copilot agents for tailored workflows, expanding the agent ecosystem with new Microsoft and partner solutions, and improving agent quality and performance. These updates build on the agents first introduced in March while giving security and IT teams more flexibility and control. This is the blueprint for the next era of agentic defense, and it starts now. 

Build your own Security Copilot agents, your way 

While we already offer a growing catalog of ready-to-use agents built by Microsoft and partners, we know that no two environments are alike. That’s why Security Copilot empowers you to create custom agents your way for tailored workflows – whether you’re an analyst with limited coding experience or a developer using your favorite platform – you can build agents that fit your needs. 

Build agents in the Security Copilot portal

Users can now build agents with a simplified, no-code interface in the standalone Security Copilot experience. Simply describe the task or workflow in natural language, and Copilot automatically generates the agent code. You can edit components, add any additional tools, including Sentinel MCP tools from our rich tool catalog, test the agent, optimize its instructions, and publish directly to your tenant. Create dynamic, ready-to-use agents in minutes – without writing any code. 

Build agents in a preferred MCP server-enabled development environment

For teams with experienced developers, you can also use natural language and vibe-coding to build agents in a preferred MCP server-enabled coding platform, such as VS Code using GitHub Copilot. By enabling the Sentinel MCP server, developers can access MCP tools to build, refine, and deploy custom agents directly within their workspace. This approach gives full control over code, tools, and deployment while keeping the process within familiar development platforms. 

These options empower both technical and non-technical teams to rapidly create, test, and deploy custom Security Copilot agents. Organizations can automate workflows faster, design agents to their unique needs, and improve security and IT operations across the board. 

Discover new Security Copilot agents 

Since Security Copilot agents were first introduced in March, we have delivered more than a dozen Microsoft and partner-developed agents that help organizations tackle real challenges in security and IT operations. Analysts using the Conditional Access Optimization Agent in Microsoft Entra have been able to quickly uncover policy gaps, closing an average of 26 gaps per customer in just one month, with 73% of early adopters acting on at least one recommendation. The Phishing Triage Agent in Microsoft Defender has allowed analysts to shift from reactive sifting to proactive resolution, reducing triage time by up to 78%. Read how St Lukes University saves nearly 200 hours monthly in phishing alert triage and creating incident reports in minutes instead of hours. 

The Phishing Triage Agent is a game changer. It’s saving us nearly 200 hours monthly by autonomously handling and closing thousands of false positive alerts.  
– Krista Arndt, ACISO, St. Luke’s University Health Network 

We’re continuing to build on this momentum with new agents designed to address additional security and IT scenarios.  

The new Access Review Agent in Microsoft Entra tackles a common challenge: reduce access review fatigue and approving access without review. It analyzes ongoing reviews, flags anomalies or unusual access patterns, and delivers actionable guidance in a conversational interface. Reviewers can approve, revoke, or request more details right in Microsoft Teams, helping them focus on the riskiest access, make faster decisions, and strengthen compliance. With innovations like this, we’re not just reducing fatigue—we’re redefining how access governance is done, setting the standard for security agents that adapt to the way people work. Learn more about the Access Review Agent here.

And, with the growing range of agentic use cases, the new Microsoft Security Store is your one-stop shop to discover, purchase, and deploy Security Copilot agents built by Microsoft and trusted partners. Find solutions aligned for SOC, IT, privacy, compliance, and governance teams, all in one place. By uniting discovery, deployment, and publishing in a single experience, Security Store powers a thriving ecosystem that gives your team a unique advantage: access to an ever-expanding range of agent capabilities that evolve as fast as the challenges they face. 

In addition to helping customers find the right solutions, Security Store also enables partners to bring their innovations to market. Partners can build and publish Security Copilot agents and SaaS solutions to grow their business and reach new customers. Today, we are announcing 30 new partner-built agents as well as 50 partner SaaS solutions in the Security Store.  

The launch of 30 new partner-built agents brings forward solutions like:  

  • A Forensic Agent by glueckkanja AG delivers deep-dive analysis of Defender XDR incidents to accelerate investigations, while their Privileged Admin Watchdog Agent helps enforce zero standing privilege principles by getting rid of persistent admin identities. These innovations, along with their other 6 agents in the Security Store today, demonstrate how glueckkanja AG is empowering organizations to tackle a wide range of security and IT challenges.  
  • 3 agents from adaQuest focused on automating investigation and response to focus security teams on what matters. A Ransomware Kill Chain Investigator Agent by adaQuest automates ransomware triage, an Entity Guard Investigator Agent by adaQuest investigates Defender incidents, and an Admin Guard Insight Agent analyzes administrative activity, detects anomalies, evaluates risk exposure and compliance, offering actionable insights to improve administrative security posture.  
  • An Identity Workload ID Agent by Invoke empowers identity administrators and security teams to manage and secure Workload Identities in Microsoft Entra, helping to reduce risk, strengthen compliance, provide more control over identity sprawl.  

To learn more about all new partner-built agents as well as partner SaaS offerings, read the blog or head to the Microsoft Security Store. 

Smarter, faster Security Copilot agents 

High-quality LLM instructions are critical to agent performance, yet manually fine-tuning them is time-consuming and error-prone. We’re excited to introduce tools that help improve custom-built agent quality and performance, starting with autotune instruction optimization. Autotune eliminates the need for manual tuning by automatically analyzing and refining agent instructions for optimal performance. Simply enable autotune during testing and submit, then receive a detailed results report with suggested prompt changes boost your agent’s AI quality score quickly and effortlessly. This optimization not only delivers better outcomes faster, but it also ensures that every agent in our ecosystem is always evolving – making them smarter, sharper, and more effective over time. 

But instructions are only part of the picture. To truly empower agents, context and data is key. By combining rich security signals from Microsoft Sentinel with advanced AI reasoning, Microsoft is setting a new standard for what agents can achieve—resolving incidents faster, optimizing workflows, and delivering deeper, more actionable insight. Security Copilot leverages a unified foundation of structured, graph, and semantic data from Sentinel to give agents the context they need to connect the dots across your environment. This deep integration transforms what AI can do, enabling agents to reason, adapt, and act with precision at machine speed. Read the Sentinel graph announcement here. 

Get Started Today

With Security Copilot, the power of AI is now in your hands. Deploy ready-to-use agents from Microsoft and partners, or design custom agents built for your environment and workflows. These agents accelerate decision-making, surface critical insights, and let teams focus on strategic security work – turning complexity into clarity and speed. Explore Security Store today to experience how agentic automation is reshaping security operations and unlocking the full potential of your team. Learn more about how to create your own agents. 

Deep dive into these innovations at Microsoft Secure on Sept. 30, Oct. 1 or on demand. Then, join us at Microsoft Ignite, Nov, 17–21 in San Francisco, CA or online—for more innovations, hands-on labs, and expert connections. 

Agentic security your way: Build your own Security Copilot agents

Supercharging Security Copilot with Logic Apps: Best practices and pro tips

This post was originally published on this site.


Integrating Microsoft Security Copilot with Azure Logic Apps enables security teams to automate investigations, orchestrate fast incident response, and unify workflows across the modern enterprise. By leveraging the unique strengths of both platforms, organizations can achieve scalable, efficient, and actionable security automation. 

Why Integrate Security Copilot with Logic Apps?

Security Copilot brings AI-powered reasoning, automation, and natural language-to-action workflow capabilities. When paired with Logic Apps, it enables:

  • Seamless orchestration: Launch incident investigations or automated email analysis with a single trigger.
  • Advanced automation: Integrate across Microsoft and third-party security tools without heavy coding.
  • Consistent, repeatable outcomes: Use Security Copilot’s prompts and promptbooks for security-centric routines and reduce potential for error .

Common scenarios include incident response initiation, scheduled security reports, and automated threat intelligence gathering.

Best Practices for designing robust workflows:

  1. Identify your use case

Not all scenarios require automation. Likewise, not all use cases benefit equally from combining automation with AI enrichment. The first step in unlocking value from Azure Logic Apps and Security Copilot is selecting the right use cases—those that align with both operational needs and the capabilities of these tools.

To identify a suitable use case, we suggest the following guidelines:

      • Start with repetitive tasks: Look for tasks that are performed frequently and follow a predictable pattern, such as alert enrichment, ticket creation, or user access reviews. These are ideal candidates for automation via Logic Apps.
      • Assess the complexity of decision-making: If a task involves nuanced decision-making or contextual analysis—like investigating suspicious sign-ins or correlating threat indicators—Security Copilot’s AI capabilities can add significant value.
      • Evaluate data availability and integration points: Ensure the use case involves systems and data sources that Logic Apps can connect to easily (e.g., Microsoft Sentinel, Entra ID, Office 365 E-mail). While it is possible to build your own custom, connectors, the availability of built-in connectors is a key consideration for the success of the integration.
      • Consider the impact on security operations: Prioritize use cases that reduce manual effort, accelerate response times, or improve accuracy in threat detection and remediation. 
      • Check for existing playbooks or templates: Use cases that align with existing Logic Apps templates or Security Copilot skills are easier to implement and test. Microsoft’s GitHub repository for Copilot for Security or the Sentinel GitHub repos are great places to start.
      • Validate with stakeholders: Collaborate with SOC managers, incident responders, and IT admins to confirm that the selected use case addresses a real pain point and fits within current workflows.

  

  1. Optimize for performance, cost, and scale
      • Leverage direct skill invocation: This has the effect of cost reduction and faster execution as the planning process that natural language prompts must go through is bypassed.
      • Optimize Security Copilot calls: Limit Copilot calls within workflows to actions that benefit from AI-value addition such as reducing cognitive load on the Security Analyst or providing reasoning over disparate sets of facts while taking advantage of the investigation context powered by the wide range of Security Copilot skills that are native to the product 
      • Logic App tuning: Fine-tune trigger frequency and need for AI-value addition i.e. you may only need to attach a Logic App that submits security copilot prompts as part of its flow based on the complexity of the expected incidents vs all detection rules and resulting incidents

Pro Tips

i. Prototype cost-effective, complex workflows 

Prototype complex workflows with test data before deploying to production environments. You can do this by simulating Security Copilot prompts by using variable instead of actual calls to Security Copilot during the testing phase. Follow the following steps to do this:

a. Run the prompt or promptbook within Security Copilot to obtain the desired payload

b. In this example we need to execute the following promptbook as part of a workflow that involves extraction of firewall device names and their owners so that we can send them an e-mail, alerting them to block public IPs exhibiting suspicious behaviors:

Fig. 1 : Sample Promptbook for demo

c. Execute the promptbook

Fig 2. Sample promptbook run

d. Next, we prompt Security Copilot to generate an output that can be used to generate a JSON formatted payload which we will eventually use to create a schema for our Logic App ParseJSON step.

Fig 3. Output from promptbook run

e. Next, use a LLM, preferably an enterprise grade one such as Microsoft 365 or Security Copilot to generate the JSON payload

 

Fig. 4: Generated sample payload

f. Next, use the sample payload to create the input schema for the ParseJSON step in the Logic App

Fig. 5: Generate the schema using the sample payload

g. Initialize a variable and save the sample JSON-this will act as simulated output Parsed from the EvaluationResult of the Promptbook from Security Copilot-effectively avoiding any costs involved with submitting the promptbook multiple times while you test and refine your Logic App

Fig. 6 Image showing initialization and saving of variable

h. You can now run the Logic App several times without submitting any prompts to Security Copilot . If you must test with payloads that vary considerably you can still do that by not saving it in the variable, and selecting the “Run with payload” option then pasting your payload in the resulting box

 


Fig. 7 Logic App snippet showing manual execution of Logic App

 

i. Once happy with Logic App flow and output you can replace the variable with the actual Security Copilot connection for your prompt or promptbook

 

Fig. 8 Partial snapshot of sample Logic App

 

ii. Session management: Use the Session Id field to maintain investigative context—enabling multiple prompts within a workflow to share data without re-authentication. However, you can also spawn new sessions which allows for parallel execution of tasks without dependency on current session content

iii. Provide descriptive connector names: Rename default connector names as you build out your logic app. This helps to troubleshoot the Logic App or maintain it, especially if it is being done by someone other than the one that built the original one. Example below describes exactly what the step does vs the default connector names:

Fig. 9. Partial snapshot of Logic App showing descriptive names for Logic App connectors

 

iv. Use custom code: Enhance workflows with inline Python or Function App steps for specialized operations, such complex text transformations or data extractions. In the example below, a function app is used to apply a regex operation to extract the e-mail GUID. This comes in handy when you do not have a built-in connector for specific requirements or existing ones are not as efficient tor flexible as a function app would be.

 

Fig. 9 Logic App snippet showing use of the Function connector

 v. Secure your Logic App workflows

    • Managed identities: Leverage managed identities across all connectors that support this authentication method whenever you use them in your flows.
    • Obfuscate secrets in run histories: Actions that handle passwords, secrets, keys, or other sensitive information are visible by default from the run history of the Logic App. For example, if your logic app gets a secret from Azure Key Vault to use when authenticating an HTTP action, you may want to hide that secret from view by enabling the toggle button for supported actions. See below:

 

Fig. 10 showing toggle set to “on” to enable securing of outputs

 

 

You may also use source IP addresses to perform access restrictions to this data. See details in this document

Log and monitor activities: Enable logging for action taken by Logic Apps in your environment for greater visibility and control. If using Microsoft Sentinel, you can send Logic App activities to your Log Analytics workspace and benefit from queries such as the one below:

SentinelHealth

| where TimeGenerated > ago(30d)

| where SentinelResourceType == “Playbook”

| extend triggeredBy = ExtendedProperties.TriggeredByName.UserDisplayName

vi. Use parameters 

Parameters allow workflows to be dynamic and reusable by enabling the injection of context-specific data—such as usernames, incident IDs, or IP addresses—at runtime. This flexibility means a single Logic App can serve multiple scenarios without hardcoding values, improving maintainability and scalability. Additionally, parameters help enforce security best practices by supporting secure input/output handling, which protects sensitive information during execution.

Conclusion

Security Copilot and Logic Apps together unlock a flexible, AI-powered automation platform for any security operations team. By following these best practices—efficient prompt design, session context management, robust security controls, and scheduled automation—organizations can level up their security response and proactivity. To go even further, explore Microsoft’s official documentation, the Security Copilot Adoption Hub, Techcommunity blog portal and our GitHub repo. I f you have any feedback or ideas on how you think we can further improve the value delivered by these solutions working together, please reach out. Always happy to hear back from you.

 

Additional resources

Security-Copilot/Logic Apps

Microsoft Security Copilot – Microsoft Adoption

Category: Security Copilot | Microsoft Community Hub

Agentic security your way: Build your own Security Copilot agents

What’s new in Microsoft Security Copilot

This post was originally published on this site.


Security and IT teams move fast – and so does Security Copilot. This month, we’re delivering powerful new capabilities that help security and IT professionals investigate threats, manage identities, and automate protection with greater speed and precision. From AI-powered triage and policy optimization to smarter data exploration and expanded language support, these updates are designed to help you stay ahead of threats, reduce manual effort, and unlock new levels of efficiency.

Let’s dive into what’s new.

 

Improve IT efficiency with Copilot in Microsoft Intune – now generally available

IT admins can now use Security Copilot in Intune which includes a dedicated data exploration experience, allowing them to ask questions, extract insights, and take action – all from within the Intune admin center. Whether it’s identifying non-compliant devices, managing updates, or automating remediation, Copilot simplifies complex workflows and brings data and actions together in one place.
Learn more: Copilot in Microsoft Intune announcement

 

Streamline identity security with Copilot in Microsoft Entra – now generally available

Security Copilot in Microsoft Entra now brings AI-assisted investigation and identity management directly into the Entra admin center. Admins can ask natural language questions to troubleshoot sign-ins, review access, monitor tenant health, and analyze role assignments – without writing queries or switching tools. With expanded coverage and improved performance, Copilot helps teams move faster, close gaps, and stay ahead of threats.
Learn more: Copilot in Microsoft Entra announcement

 

Close gaps quickly with the Conditional Access Optimization Agent – now generally available

The Conditional Access Optimization Agent in Microsoft Entra brings AI-powered automation to identity workflows. The agent runs autonomously to detect gaps, overlaps, and outdated policy assignments – then recommends precise, one-click remediations to close them fast.

Key benefits include:

  • Autonomous protection: Automatically identifies users and apps not covered by policies
  • Explainable decisions: Plain-language summaries and visual activity maps
  • Custom adaptability: Learns from natural-language feedback and supports business rules
  • Full auditability: All actions logged for compliance and transparency

As one security leader put it:

“The Conditional Access Optimization Agent is like having a security analyst on call 24/7. It proactively identifies gaps in our Conditional Access policies and ensures every user is protected from day one… It’s a secure path to innovation that every chief information security officer can trust.”
—Julian Rasmussen, Senior Consultant and Partner, Point Taken, Microsoft MVP
Learn more: Conditional Access Optimization Agent in Microsoft Entra GA announcement

 

Investigate phishing alerts faster with the new Phishing Triage Agent in Microsoft Defender

The Phishing Triage Agent in Microsoft Defender is now in public preview, bringing autonomous, AI-powered threat detection to your SOC workflows. Powered by large language models, the agent performs deep semantic analysis of emails, URLs, and files to determine whether a submission is a phishing threat or a false alarm – without relying on static rules.

It learns from analyst feedback, adapts to your organization’s patterns, and provides clear, natural language explanations for every verdict. A visual decision map shows exactly how the agent reached its conclusion, making the process fully transparent and reviewable.

Learn more: Announcing public preview Phishing Triage Agent in Microsoft Defender

 

The Threat Intelligence Briefing Agent is now in Public Preview: Build organization-specific briefings in just minutes

The Threat Intelligence Briefing Agent has entered public preview in the Security Copilot standalone experience, transforming how security teams stay ahead of emerging threats. With this powerful agent, creating highly relevant, organization-specific threat intelligence briefings now takes minutes rather than hours or days, empowering teams to act with speed and confidence. Through real-time dynamic reasoning, the agent surfaces the most relevant threat intelligence based on attributes such as the organization’s industry, geographic location, and unique attack surface to deliver critical context and invaluable situational awareness.

Learn more: aka.ms/ti-briefing-agent

 

Streamline operations with workspace-level management

Security Copilot now supports workspaces, giving organizations a flexible way to segment environments by team, region, or business unit. With workspaces now in public preview, admins can align access, data boundaries, and SCU capacity with operational and compliance needs. Each workspace supports role-based access control, localized prompt history, and independent capacity planning – making it easier to manage complex, distributed security and IT operations.

As part of this model, workspace-level plugin management is now generally available, allowing admins to configure plugin settings at the workspace or organization level. This eliminates the need for per-user setup and improves efficiency across large environments.

Learn more: New tools for Security Copilot management and capacity planning

 

Plan smarter with the new Security Copilot Capacity Calculator

The Security Copilot Capacity Calculator is now available in the standalone experience (Azure account required), helping teams estimate how many SCUs they may need.
Security Copilot supports:

  • Provisioned SCUs for predictable workloads
  • Overage SCUs to scale with variable workloads

Teams can estimate initial capacity using the capacity calculator, monitor usage in the in-product usage dashboard, and adjust their SCU allocation as needed. Learn more about Security Copilot pricing here.

Learn more: New tools for Security Copilot management and capacity planning

 

Automate Entra workflows with embedded NL2API skill

Security Copilot can now reason over Microsoft Graph APIs to answer complex, multi-stage questions across Entra resources. This embedded experience in Entra, powered by the NL2API skill, is now generally available – bringing advanced automation and intelligence directly into your Entra workflows.

 

Get faster suggestions with dynamic suggested prompts for Entra skills

Dynamic suggested prompts are now generally available for Entra skills, offering faster and more deterministic follow-up suggestions using direct skill invocation – bypassing the orchestrator for improved performance.

 

Meet compliance needs with FedRAMP High authorization for Security Copilot

Security Copilot is now included within the Federal Risk and Authorization Management Program (FedRAMP) High Authorization for Azure Commercial. This Provisional Authorization to Operate (P-ATO) within the existing FedRAMP High Azure Commercial environment was approved by the FedRAMP Joint Authorization Board (JAB). This milestone marks a significant step forward in our mission to bring Microsoft Security Copilot’s cutting-edge AI-powered security capabilities to our Government Community Cloud (GCC) customers. Stay tuned for updates on when Security Copilot will be fully available for GCC customers.

 

Expand global reach with Korean language and Swiss data residency

Security Copilot now supports Korean in both standalone and embedded experiences. For a full list of supported languages, visit Supported languages in Microsoft Security Copilot

Additionally, customers in Switzerland can now benefit from Swiss region data residency, ensuring Security Copilot data is stored within Swiss boundaries to meet local compliance requirements.

Learn more: Availability and recovery of Security Copilot

 

Improve accuracy and scale with GPT-4.1 and large output support

We’ve upgraded Security Copilot to support GPT-4.1 across all experiences at the evaluation level, offering larger context windows, improved interactions, and up to 50% accuracy improvements in some scenarios.

Also now generally available is large output support, which removes the previous 2MB limit for data used in LLMs – giving teams more flexibility when working with large datasets.

 

Audit agent changes with Purview UAL integration

Agent administration auditing is now generally available in Microsoft Purview Unified Audit Log, allowing teams to trace agent creation, updates, and deletions with detailed metadata for improved visibility and compliance.

Learn more: Access the Security Copilot audit log

 

Stay tuned and explore more!

Security Copilot is transforming how security and IT teams operate – bringing AI-powered insights, automation, and decision support into everyday workflows. With new capabilities landing every month, the pace of innovation is accelerating.

We’ll be back in September with more updates. Until then, explore these resources to get hands-on, deepen your understanding, and see what’s possible:

 

Don’t miss Microsoft Secure digital event on September 30th – we’ll be announcing exciting new capabilities for Security Copilot and sharing what’s next in AI-powered security. Register now to be the first to hear the announcements and see what’s coming.

Agentic security your way: Build your own Security Copilot agents

New tools for Security Copilot management and capacity planning

This post was originally published on this site.


Last year, we launched Microsoft Security Copilot with a bold goal: to help organizations protect at the speed of AI. Since then, Security Copilot has been transforming how IT and security operations teams respond to threats and manage their environments. In fact, research from live operations indicates that Security Copilot users have seen impact like a 30% reduction in mean time to resolution for SOC teams, and a 54% decrease in time to resolve a device policy conflict for IT teams. 

As adoption has grown, so has the complexity of customer needs. In many organizations, different teams, business units, and regions require distinct approaches to data access, capacity planning, and tooling. At the same time, customers want the flexibility to start small, test scenarios, and scale usage over time, without committing to long-term contracts. 

To meet these needs, Security Copilot is offered as a consumptive solution, allowing organizations to provision Security Compute Units (SCUs) as needed. This flexible model lowers the barrier to entry and encourages experimentation. And now, with workspaces and the Security Copilot capacity calculator to help manage capacity, customers can adopt Security Copilot with even more confidence and control. 

Workspaces 

Security operations don’t happen in a vacuum – different teams, business units, and regions have unique operational needs. This is why we’re excited to launch workspaces in public preview – a major enhancement to how teams can manage access, resources, and collaboration within Security Copilot. Workspaces provide a flexible way to segment environments, making it easier to align access and capacity with organizational needs, legal structures, or compliance requirements. 

 

Let’s take the example of a multinational organization with separate security and IT teams in North America, Europe, and Asia. With workspaces, this company can realize benefits in: 

  • Data boundaries: Each regional team operates within its own dedicated workspace, keeping data like prompt history local and accessible only to that team. This isolation ensures information stays relevant to the team and supports compliance with regional data residency requirements and internal policies. 
  • Role-based access control: Only authorized users specified by the admin have access to each workspace, and workspace management is restricted to users with administrator roles. 
  • Capacity planning: SCUs can be provisioned per workspace, giving admins the ability to right-size capacity based on each team’s workload. APAC can scale up during a surge while the US conserves usage during a quiet period. 

 Note: multi-workspace support is now available in Security Copilot, enabling users to manage prompt sessions across multiple workspaces. However, available agents that run autonomously are currently limited to a single workspace, and embedded experiences continue to route traffic exclusively through the tenant-level default workspace. Please refer to the documentation for full details. 

Security Copilot capacity calculator 

One of the most common questions we hear from customers is: “How many SCUs do I need to get started with Security Copilot?” Given the dynamic nature of AI-powered security workflows, forecasting compute needs can be a challenge, especially for teams just starting their journey. To make planning easier, we’re excited to announce the launch of the Security Copilot capacity calculator, now available in the Security Copilot standalone experience (Azure account required). 

This tool offers a practical starting point to help estimate how many SCUs your organization may require. With a few clicks, customers can get an idea of estimated SCU usage based on inputs like number of users in an embedded Security Copilot experience. While actual consumption may vary as it depends on real-time prompt activity, the calculator serves as a helpful guide for initial provisioning and budget planning.  

Once you’ve estimated your baseline needs, you can get started in Security Copilot or in the Azure portal. Security Copilot offers two flexible models to support both predictable workloads and unplanned spikes in usage: 

  • Provisioned SCUs: Ideal for predictable, ongoing operations. A minimum of one provisioned SCU is required. 
  • Overage SCUs: Designed for variable demand. Overage SCUs allow usage to scale seamlessly, and customers only pay for what they use, up to their chosen optional overage limit. 

With the capacity calculator, organizations can confidently begin their Security Copilot journey and better manage usage to align with their business needs. After getting started, teams can monitor consumption through the in-product usage dashboard and adjust capacity as demand fluctuates. Learn more about Security Copilot pricing here. 

Get Started with Security Copilot today 

Together, workspaces and the capacity calculator provide organizations with deeper insight, flexibility, and control over their Security Copilot usage. These features address the real-world challenges of managing diverse teams, complex environments, and evolving workloads. Whether you’re just starting your Security Copilot journey or looking to optimize your existing usage, these tools help you right-size capacity, maintain compliance, and deliver actionable AI assistance for your security and IT teams. 

Discover Security Copilot use cases, best practices, and customer success stories in the Security Copilot adoption hub. Learn more about our most recent Security Copilot innovations for IT teams here. If you have questions or need support, don’t hesitate to contact us or reach out to your account manager. 

Agentic security your way: Build your own Security Copilot agents

Smarter Prompts for Smarter Investigations: Dynamic Prompt Suggestions in Security Copilot

This post was originally published on this site.


When a security analyst turns to an AI system for help—whether to hunt threats, investigate alerts, or triage incidents—the first step is usually a natural language prompt. But if that prompt is too vague, too general, or not aligned with the system’s capabilities, the response won’t be helpful. In high-stakes environments like cybersecurity, that’s not just a missed opportunity, it’s a risk.

That’s exactly the problem we tackled in our recent paper, Dynamic Context-Aware Prompt Recommendations for Domain-Specific Applications, now published and deployed as a new skill in Security Copilot.

Why Prompting Is a Bigger Problem in Security Than It Seems

LLMs have made impressive progress in general-purpose settings—helping users write emails, summarize documents, or answer trivia. These systems often include smart prompt recommendations based on the flow of conversation. But when you shift into domain-specific systems like Microsoft Security Copilot, the game changes.

Security analysts don’t ask open-ended questions. They ask task-specific ones:

  • “List devices that ran a malicious file in the last 24 hours.”
  • “Correlate failed login attempts across services.”
  • “Visualize outbound traffic from compromised machines.”

These questions map directly to skills—domain-specific functions that query data, connect APIs, or launch workflows. And that means prompt recommendations need to be tightly aligned with the available skills, underlying datasets, and current investigation context. General-purpose prompt systems don’t know how to do that.

What Makes Domain-Specific Prompting Hard

Designing prompt recommendations for systems like Security Copilot comes with unique constraints:

  1. Constrained Skill Set: The AI can only take actions it’s configured to support. Prompts must align with those skills—no hallucinations allowed.
  2. Evolving Context: A single investigation might involve multiple rounds of prompts, results, follow-ups, and pivots. Prompt suggestions must adapt dynamically.
  3. Deep Domain Knowledge: It’s not enough to suggest “Check network logs.” A useful prompt needs to reflect how real analysts work—across Defender, Sentinel, and more.
  4. Scalability: As new skills are added, prompt systems must scale without requiring constant manual curation or rewriting.
Our Approach: Dynamic, Context-Aware, and Skill-Constrained

 

We introduce a dynamic prompt recommendation system for Security Copilot. The key innovations include:

  • Contextual understanding of the session: We track the user’s investigation path and surface prompts that are relevant to what they’re doing now, not just generic starters.
  • Skill-awareness: The system knows what internal capabilities exist (e.g., “list devices,” “query login events”) and only recommends prompts that can be executed via those skills.
  • Domain knowledge injection: By encoding metadata about products, datasets, and typical workflows (e.g., MITRE attack stages), the system produces prompts that make sense in security analyst workflows.
  • Scalable prompt generation: Rather than relying on hardcoded lists, our system dynamically generates and ranks prompt suggestions.
What It Looks Like in Action

The dynamic prompt suggestion system is now live in Microsoft Entra, available in both Embedded and Immersive experiences. When a user enters a natural language prompt, the system automatically suggests several context-aware follow-up prompts, based on the user’s prior interactions and the system’s understanding of the current task.

 

These suggestions are generated in real time—users can simply click on a suggestion, and it’s executed immediately, allowing for quick and seamless follow-up queries without needing to rephrase or retype.

Let’s walk through two examples:

Embedded Experience

We begin with the prompt: “How does Microsoft determine Risky Users?”

 

The system returns the response and generates 3 follow-up suggestions, such as: “List dismissed risky detections.”

We click on that suggestion, which executes the query and shows the results.

New suggestions continue to appear after each prompt execution, making it easy to explore related insights.

Immersive Experience

We start with a prompt: “Who am I?”

 

Among the 5 suggested prompts, we select: “List the groups user nase74@woodgrove.ms is a member of.”

The user clicks, the query runs, and more follow-up suggestions appear, enabling a natural, guided flow throughout the session.

 

Why This Matters for the Future of Security AI

Prompting isn’t just an interface detail—it’s the entry point to intelligence. And in cybersecurity, where time, accuracy, and reliability matter, we need AI systems that are not just capable, but cooperative. Our research contributes to a future where security analysts don’t have to be prompt engineers to get the most out of AI.

By making prompt recommendations dynamic, contextual, and grounded in real domain knowledge, we help close the gap between LLM potential and security reality.

 

Interested in learning more?
Check out the full paper: Dynamic Context-Aware Prompt Recommendations for Domain-Specific Applications

If you’re using or building upon this work in your own research, we’d appreciate you citing our paper:

@article {tang2025dynamic,
title={Dynamic Context-Aware Prompt Recommendation for Domain-Specific AI Applications},
author={Tang, Xinye and Zhai, Haijun and Belwal, Chaitanya and Thayanithi, Vineeth and Baumann, Philip and Roy, Yogesh K},
journal={arXiv preprint arXiv:2506.20815},
year={2025}
}