What's changed: Added per-section figures (cert-figure-retrofit). New SC-500 Chapter 4 (Domain 4 "Manage and monitor posture": Defender for Cloud = CSPM(recommendations/Secure Score/attack paths/regulatory compliance)-CWP plans-multicloud(AWS/GCP)-Defender Vulnerability Management-EASM; Microsoft Sentinel = workspaces/roles/content hub/data connectors/Syslog-CEF/Windows events(DCR-WEF)/custom tables/automation rules-playbooks/data retention/Purview Audit in Defender XDR; Microsoft Security Copilot = workspaces/permissions-roles/plugins/Microsoft-Security Store agents)
4.3Microsoft Security Copilot
Learn Microsoft Security Copilot, which applies generative AI to security operations: configuring workspaces, managing permissions and roles, enabling and configuring plugins, and enabling and configuring Microsoft agents and Security Store agents.
Microsoft Security Copilot brings generative AI to security operations (SecOps), enabling natural-language incident summarization, KQL generation assistance, threat explanation, and response guidance. SC-500 focuses less on feature minutiae and more on "how to configure and govern it safely" (workspaces, permissions, plugins, agents).
4.3.1Workspaces and permissions/roles
Configure a Security Copilot workspace and allocate capacity such as Security Compute Units (SCUs). Control access with permissions and roles, managing who can use Copilot and which data sources (via plugins) they can reach, with least privilege. By design, Copilot should operate within the user’s existing permissions in connected products (Defender, Sentinel, Intune, Entra, etc.).
4.3.2Plugins and agents
Plugins connect Security Copilot to data sources/products (Microsoft, third-party, web, etc.); enable and configure them to scope reach. Microsoft agents and Security Store agents semi-autonomously perform specific SecOps tasks (phishing triage, vulnerability remediation suggestions, conditional access optimization, etc.); enable only what you need and configure permissions and plugins with least privilege. When deploying agents, the same governance learned in Chapter 3 (identity, least privilege, monitoring) applies.
| Item | Role | Key point |
|---|---|---|
| Workspace | Usage foundation; allocate capacity (SCUs) | Capacity management |
| Permissions/roles | Who can access what | Least privilege; within user permissions |
| Plugins | Connect to data sources/products | Enable/configure to scope reach |
| Agents | Semi-autonomous SecOps tasks | Enable only needed; least privilege |
Watch the mix-ups: (1) plugins (connect to data sources/products) vs agents (semi-autonomously perform tasks). (2) Security Copilot should operate within the user’s existing permissions—do not over-grant Copilot. (3) The Entra Agent ID / agent governance from Chapter 3 applies equally to SecOps agents.
Map requirement → feature: "connect Copilot to a specific data source/product" = enable/configure plugins; "control who can use Copilot" = permissions and roles; "semi-autonomously triage phishing" = Microsoft/Security Store agents; "avoid over-granting Copilot" = operate within user permissions + least privilege.
4.3.3Section summary
- Security Copilot = generative AI for SecOps (investigation summaries, KQL help, response guidance); SC-500 focuses on safe configuration/governance
- Workspace + permissions/roles (least privilege; within user permissions) + plugins (connections)
- Enable only the needed Microsoft/Security Store agents with least privilege (apply Chapter 3 agent governance)
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. What connects Microsoft Security Copilot to data sources and products (Microsoft and third-party)?
Q2. Which is the most appropriate access design for Security Copilot?
Q3. Which semi-autonomously performs SecOps tasks like phishing triage and vulnerability remediation suggestions?
Q4. What do you configure as the usage foundation for Security Copilot, allocating capacity (Security Compute Units)?
Q5. Which correctly distinguishes plugins from agents?
Q6. What is the most appropriate governance when deploying SecOps agents (Security Copilot agents)?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.