Provision Microsoft Security Copilot, configure SCU capacity and plugins, run your first standalone investigation using natural-language prompts, interpret Copilot-generated incident summaries, and establish foundational SOC practices for AI-assisted security operations.
Microsoft Security Copilot is a generative-AI security solution that augments human analysts with natural-language investigation, cross-product correlation, and automated reporting capabilities. In this lab you will provision the service from scratch, configure Security Compute Units (SCUs) for capacity management, enable plugins that connect Copilot to your deployed Microsoft security products, and run end-to-end investigations using prompts in the Standalone portal. By the end of this lab you will be able to investigate incidents, analyse entities, generate executive reports, and establish session management best practices. all powered by AI.
A global retail company with 5,000 endpoints and a 4-person SOC team processes over 200 alerts per day across Defender XDR, Sentinel, and Entra ID. Their mean-time-to-investigate (MTTI) for high-severity incidents averages 45 minutes, and analysts spend 30% of their time writing incident reports for management. The CISO wants to deploy Security Copilot to reduce MTTI to under 15 minutes, automate executive-level reporting, and allow Tier 1 analysts to handle investigations that previously required Tier 2 expertise. effectively multiplying the team’s capacity without hiring additional staff.
SOCs are overwhelmed: the average enterprise generates over 11,000 security alerts per day, and the global cybersecurity talent shortage exceeds 3.4 million professionals. AI-augmented security operations address both challenges simultaneously. Security Copilot reduces investigation time by up to 65% according to Microsoft’s internal benchmarks, enables junior analysts to perform senior-level triage, and ensures consistent, reproducible investigations across the team. Mastering Copilot is no longer optional. it is a force multiplier that transforms how modern SOCs operate.
Security Copilot runs on Security Compute Units (SCUs), which are billed per hour. Each SCU provides a fixed amount of compute capacity for prompts and sessions. You provision capacity through the Azure portal, then access the Copilot experience in the standalone portal or embedded within Defender XDR and Sentinel.
rg-copilot-lab if needed)1 for evaluation# PURPOSE: Create a dedicated resource group for Security Copilot lab resources
# WHY: Isolates Copilot resources for easy cost tracking and cleanup
# OUTPUT: JSON with resource group properties (id, location, provisioningState)
az group create \
--name rg-copilot-lab \
--location eastus \
--tags Environment=Lab Project=CopilotLab
# PURPOSE: Provision Security Copilot with 1 Security Compute Unit (SCU)
# WHY: SCUs provide compute capacity for prompts and sessions - billed per hour
# COST: ~$4/hour per SCU - start with 1 for evaluation, scale up as needed
# REQUIRED ROLE: Owner or Contributor on the Azure subscription
# OUTPUT: Capacity resource JSON with provisioning state and billing endpoint
az security copilot capacity create \
--resource-group rg-copilot-lab \
--name copilot-capacity-lab \
--location eastus \
--sku-name SCU \
--capacity 1The standalone experience is where you interact with Copilot through natural-language prompts in a session-based interface. Each session maintains context from previous prompts, enabling multi-step investigations without re-explaining the scenario.
Plugins are what connect Security Copilot to your data. Without the right plugins enabled, Copilot cannot query your security products. Each plugin gives Copilot access to a specific product’s data and capabilities.
Now it’s time to interact with Copilot! Start with a broad prompt to explore what data is available, then progressively narrow your focus. Good prompts are specific, contextual, and tell Copilot what format you want the answer in.
# Prompt 1: Get an overview of recent incidents
# PLUGINS INVOKED: Microsoft Defender XDR + Microsoft Sentinel (auto-selected)
# PURPOSE: Quick situational awareness of your current threat landscape
# OUTPUT: List of high/critical incidents with title, severity, entities, and status
# TIP: Copilot queries both XDR and Sentinel to aggregate cross-product incidents
Tell me about the latest critical and high-severity incidents
in my environment from the last 7 days. Include the incident
title, severity, affected entities, and current status.Show me the most recent 5 alerts from any severity levelSelect one of the incidents from the previous response and deep-dive into it. Copilot maintains session context, so it knows which incident you’re referring to.
# Prompt 2: Deep-dive into an incident
# PLUGIN: Microsoft Defender XDR (incident timeline, alert correlation)
# PURPOSE: Builds a chronological event timeline for a specific incident
# WHY: Session context carries forward - Copilot knows which incident you mean
# OUTPUT: Timeline with alerts, entities, MITRE ATT&CK techniques, lateral movement
Give me a detailed timeline of the first incident you listed.
Include all related alerts, affected entities, MITRE ATT&CK
techniques, and evidence of lateral movement or data exfiltration.
# Prompt 3: Ask about the attack chain
# PLUGINS: Microsoft Defender XDR + Threat Intelligence (MDTI)
# PURPOSE: Maps the full attack kill chain from initial access to current state
# OUTPUT: Step-by-step kill chain with MITRE ATT&CK technique IDs (e.g., T1566)
What was the initial access vector for this incident?
Walk me through the kill chain step by step.Entity analysis is one of Copilot’s most powerful features. It aggregates data across Entra ID, Defender for Endpoint, and Sentinel to build a comprehensive profile in seconds. a task that would take an analyst 15–20 minutes manually.
# Prompt 4: Investigate a user entity
# PLUGINS: Entra ID (risk, sign-ins) + Defender XDR (alerts) + Intune (devices)
# PURPOSE: Cross-product user profiling - aggregates identity, endpoint, and app data
# OUTPUT: Risk level, MFA status, anomalous sign-ins, device list, associated alerts
What do we know about user john.doe@contoso.com?
Show me their risk level, recent sign-in anomalies,
devices they have used, and any associated alerts.
# Prompt 5: Investigate an IP address
# PLUGINS: MDTI (reputation, geolocation) + Defender XDR (incident correlation)
# PURPOSE: Determines if an IP is malicious and whether it appears in your tenant
# OUTPUT: Geolocation, TI reputation verdict, related incidents, historical activity
Analyse the IP address 203.0.113.42. Is this a
known malicious IP? Show geolocation, reputation,
and any connections to incidents in our environment.
# Prompt 6: Investigate a device
# PLUGINS: Defender for Endpoint (alerts, CVEs) + Intune (compliance status)
# PURPOSE: Full device security posture assessment in a single query
# OUTPUT: Active alerts, CVE exposure, compliance status, OS version, last seen time
Show me the security posture of device DESKTOP-LAB01.
Include recent alerts, software vulnerabilities, and
whether the device is compliant with our Intune policies.Copilot automatically correlates data across multiple products. When you ask about a user, it pulls data from:
Automated report generation saves analysts 30–45 minutes per major incident. Copilot produces well-structured summaries suitable for leadership, compliance teams, or incident management systems.
# Prompt 7: Executive summary
# PURPOSE: Auto-generates a CISO-ready incident briefing from session context
# WHY: Saves analysts 30-45 min of manual report writing per incident
# OUTPUT: Non-technical summary with business impact, status, root cause, next steps
# TIP: Review and add human context (stakeholder concerns, budget) before sharing
Generate an executive summary of this incident suitable for
sharing with the CISO. Include the business impact, current
containment status, root cause, and recommended next steps.
# Prompt 8: Technical detail report
# PURPOSE: Generates a detailed technical IR report for the SOC/IR team
# OUTPUT: Full timeline, evidence artifacts, IOCs (IPs/hashes/URLs), MITRE mapping,
# and prioritised remediation actions with responsible teams
# TIP: Copy this into your ITSM tool (ServiceNow, Jira) for formal incident tracking
Create a detailed technical report for this incident.
Include the full attack timeline, evidence artifacts,
IOCs discovered, MITRE techniques, and remediation
actions taken or recommended.Sessions are your investigation record. They maintain full context and can be reviewed by new team members to understand the entire investigation thread.
INC-2026-0042-Phishing-Investigation)Understanding SCU consumption is critical for cost management. Each prompt and plugin invocation consumes compute capacity. Monitoring usage helps you right-size your SCU allocation.
# PURPOSE: Authenticate to Microsoft Graph with security read permissions
# SCOPE: SecurityEvents.Read.All - required to query Copilot capacity info
# PREREQ: Install-Module Microsoft.Graph -Scope CurrentUser
Connect-MgGraph -Scopes "SecurityEvents.Read.All"
# PURPOSE: Query the Copilot capacity API to check provisioned SCU count
# ENDPOINT: Beta API - subject to change; check docs.microsoft.com for GA status
# OUTPUT: JSON array of capacity resources with name, region, and SCU config
$capacity = Invoke-MgGraphRequest -Method GET `
-Uri "https://graph.microsoft.com/beta/security/copilot/capacities"
# PURPOSE: Display capacity details in a human-readable format
# OUTPUT: Capacity name, deployment region, and current SCU count + billing state
$capacity.value | Select-Object name, location, properties | Format-ListIf you are running this in a lab environment, consider scaling down or removing the capacity to avoid ongoing charges.
# PURPOSE: Scale Security Copilot capacity down to stop hourly billing
# WHY: Setting to 0 SCUs pauses charges but preserves all configuration
# NOTE: Scale back up instantly at any time without re-provisioning
az security copilot capacity update \
--resource-group rg-copilot-lab \
--name copilot-capacity-lab \
--capacity 0
# PURPOSE: Permanently delete all lab resources to stop ALL charges
# FLAGS: --yes skips interactive confirmation prompt
# --no-wait returns immediately (deletion runs asynchronously)
# WARNING: Deletes the resource group and ALL resources inside it - irreversible
az group delete --name rg-copilot-lab --yes --no-wait| Resource | Description |
|---|---|
| Get started with Security Copilot | Initial setup, provisioning, and first-run guide |
| Manage Security Copilot usage | Monitor and manage SCU consumption and capacity |
| Using prompts in Security Copilot | Best practices for writing effective prompts |
| Plugins in Security Copilot | Overview of built-in and custom plugins |
| Authentication in Security Copilot | Permissions, roles, and access control configuration |
| Navigating Security Copilot | Standalone and embedded experience overview |
| Prompting tips and techniques | Advanced prompt engineering for security scenarios |
| Security Copilot FAQ | Frequently asked questions about pricing, data, and privacy |