Security Copilot's Advantage Is the Microsoft Security Graph

AI · Microsoft · Security · Microsoft 365 · Enterprise
An analyst reviews evidence from separate tools in an open incident case, with one empty evidence channel and a hand paused over an orange response lever

I would buy Security Copilot for the evidence an analyst can reach under the right permissions. The chat box adds convenience. Microsoft's stronger advantage lies in connecting an incident to identity, endpoint and data-security context, then giving the analyst evidence to inspect before a response. You lose that advantage when your organisation has patchy telemetry, fragmented identities or an incident process nobody owns.

Microsoft calls the product Microsoft Security Copilot.[13] It offers a standalone portal and embedded experiences across its security products.[13] I checked the documentation on 26 October 2026. This article assesses the documented product, not results from a tenant trial.

The graph matters when an analyst can follow the evidence

I use "Microsoft Security Graph" here as shorthand for the connected security context, not as the name of a single Security Copilot database. Microsoft names its graph analytics capability Microsoft Sentinel graph, while Security Copilot also reaches product data through plugins.[24][13]

Buying the assistant does not mean an analyst can query your entire estate through one universal interface.

Microsoft describes grounding through plugins as context retrieval at inference time, rather than training the underlying model on your organisation's incidents.[13] You need current records and working integrations. You cannot compensate for missing endpoint events by choosing a model with a better security vocabulary. An analyst investigating a suspicious sign-in needs to establish which identity acted, which device it used and what happened next. I want each connection to survive inspection. A paragraph that joins two similar display names deserves less trust than an investigation tied to the correct account and device identifiers.

Cross-product context requires configured sources

In Defender, Security Copilot can summarise an incident's timeline, assets and indicators, with links from evidence to relevant entity pages.[18] In Entra, Microsoft documents access through its plugin to users, groups, sign-in logs and audit logs, alongside identity-risk investigations in the admin centre.[20] That gives an analyst a route from an incident to identity records, subject to access and available data.

Intune adds device, policy and compliance context; its embedded Copilot respects Intune roles and scope tags.[21] A security analyst and an endpoint administrator may therefore receive different answers about the same fleet. I would test that difference before using either answer in an incident briefing.

Purview provides another distinct evidence set. Microsoft documents DLP and insider-risk alert summaries, plus standalone capabilities for triage and investigation through the Purview plugin.[22] For an investigation into suspected data theft, that context can change which questions the analyst asks after finding a compromised account.

Sentinel connects the argument to SIEM investigations. Microsoft documents incident summaries through the standalone plugin and embedded portals, but its Sentinel summary page still marks the feature as preview.[23] Do not turn an integration list into a promise that every cross-product workflow has reached general availability. Test the specific experience you intend to deploy.

Users can enable or disable plugin sources, and the Sentinel plugin has a configurable default workspace.[11] A source outside the chosen scope contributes no evidence to your answer. I would ask which sources a demonstration used before judging its apparent breadth.

Summarisation, investigation and action need separate tests

A useful summary compresses evidence the analyst already has. In Defender, Microsoft says summaries cover incidents with up to 100 alerts, and their content depends on available data.[18] Evaluate whether the analyst can open the cited evidence and reconstruct the sequence without repairing factual errors.

Investigation asks a harder question: what would confirm or disprove the suspected attack? Microsoft documents cross-source correlation, script analysis and KQL generation, but warns that generated code can look valid while failing to match the requested task.[13] Have the analyst inspect the query's time range, entity scope and results. Generating a query does not establish that anyone ran it or that the returned rows support the verdict.

Action adds operational risk. Defender's guided-response workflow asks the analyst to review recommendations before selecting an action; permissions limit available buttons, and cards can identify actions that existing Defender automation has performed.[19] Do not credit the assistant for containment that another control completed.

Agents add a separate authority model. Microsoft describes administrator-configured identities, permissions and triggers, with some agents able to act within those boundaries.[25] A human review gate in one guided-response experience does not prove that another agent waits for approval before each change. I would require explicit approval for account suspension or device isolation until the team has tested the chosen workflow and its recovery path.

Permissions protect retrieval, not every later disclosure

Security Copilot owner and contributor roles grant platform access; they do not grant access to the underlying security data.[8] Microsoft plugins use on-behalf-of authentication, with product roles still governing access, while plugins with their own authentication follow that setup.[8][11] Adding an analyst to Copilot therefore does not solve missing Sentinel permissions.

Microsoft says an authorised session viewer does not need the originating plugin's service permissions to see its results, and a session includes its prompts and responses.[8] Treat session sharing as a disclosure decision. Do not assume that an Intune boundary follows copied evidence into a conversation.

For each agent, record the identity, readable sources and permitted actions. Microsoft distinguishes an agent's configured identity from the analyst's interactive use.[25] I would test with a restricted analyst account and review session-sharing access as a separate control. Broad administrator access makes a demonstration easier while concealing permission failures that staff will face on shift.

Included capacity still needs a budget owner

Microsoft now includes Security Copilot capacity with eligible Microsoft 365 E5 and E7 licences, alongside the standalone capacity purchase.[1] Its current guidance grants 400 Security Compute Units per month for every 1,000 paid user licences, capped at 10,000.[1] It still describes phased tenant enablement, so eligibility alone does not establish access.[1]

Customers outside that inclusion use provisioned capacity, with a minimum of one SCU and billing by the hour; overage capacity follows consumption.[2] The inclusion guidance excludes costs such as Sentinel data-lake storage and compute, Logic Apps usage and partner-agent licences.[1]

Keep the AI capacity allowance separate from the cost of collecting and retaining useful evidence.

The same inclusion page describes future throttling and a future paid expansion option after advance notice.[1] I would confirm the tenant's present terms before putting an incident-response dependency on that arrangement. "Included" gives a team a reason to run a measured pilot, not a reason to skip cost ownership.

Data boundaries and auditability need proof

For auto-provisioned E5 and E7 tenants, Microsoft defaults the two human-review data-sharing options to off and Microsoft 365 service-data access to on.[4] The privacy guidance scopes that Microsoft 365 access to data that Purview processes or generates.[17] For tenants with data storage outside the EU, it documents global prompt processing as the default.[4] An Australian storage location therefore does not establish Australian processing. Review the actual workspace and owner settings with your privacy team.

Microsoft says it does not share customer data with OpenAI or use it to train Azure OpenAI foundation models.[17] Separate opt-in settings permit human review and development of Microsoft's security-specific models.[17] Those statements describe different uses. Record the selected controls instead of reducing the review to a vendor assurance about training.

Microsoft's Security Copilot audit guidance distinguishes administrative events and activity metadata in the Unified Audit Log from prompt-and-response content through Purview DSPM for AI.[9] Teams must enable the integration and configure the relevant Purview capabilities and permissions.[9]

Before a pilot passes, have someone other than the operator recover a sample interaction and its administrative history. Preserve the analyst's decision and the resulting action in the incident record. An available logging feature does not prove your reviewers can reconstruct an investigation.

Missing telemetry can make a neat answer dangerous

Consider a hypothetical stolen-account investigation. Your team has Entra sign-ins, but the laptop never enrolled in endpoint monitoring. A business unit sends no application logs to the SIEM. Two account names refer to the same person, and nobody maintains that mapping.

An analyst can ask for a confident account of the attack and receive a plausible sequence from the surviving records. The missing records remain missing. Microsoft warns that output quality depends on available sources and enabled integrations, and that responses can be incomplete or wrong.[13]

I would require the case record to distinguish an observed event from an inference, and both from a source the analyst could not check. "No matching event in the queried scope" needs a stated scope and time range. It cannot establish that the attacker did nothing elsewhere.

Weak process adds another gap. If nobody owns escalation, a faster summary gives the next person more text to inherit. Define who investigates, who approves disruption and who verifies recovery before measuring time saved.

A CISO should buy fewer reconstruction steps

A generic LLM can help explain a script or draft an incident report from material you provide. Give it governed connectors and you can build a stronger competitor. The comparison concerns the work your team must do to retrieve evidence, enforce permissions and preserve an audit trail.

I would judge Security Copilot against that integration burden. Its advantage grows where your team already maintains the connected Microsoft estate. In a fragmented environment, compare it with the investigation platform that holds the relevant records, including the cost of rebuilding missing connections.

For a buying decision, I would use four gates:

My bet: over the next eighteen months, Microsoft will make Security Copilot harder to separate from routine security administration through embedded experiences and included capacity. The strongest adopters will spend their effort on telemetry coverage and reviewable incident decisions. Organisations that skip that work will produce faster briefings while their analysts still struggle to establish what happened.

Sources: [1] Security Copilot for Microsoft 365 E5 and E7 customers (Microsoft, accessed 26 October 2026); [2] Security Copilot compute units and capacity (Microsoft, accessed 26 October 2026); [4] Security Copilot auto provisioning (Microsoft, accessed 26 October 2026); [8] Authentication in Security Copilot (Microsoft, accessed 26 October 2026); [9] Access the Security Copilot audit log (Microsoft, accessed 26 October 2026); [11] Use plugins in Security Copilot (Microsoft, accessed 26 October 2026); [13] Security Copilot application card (Microsoft, accessed 26 October 2026); [17] Privacy and data security in Security Copilot (Microsoft, accessed 26 October 2026); [18] Summarise incidents with Copilot in Defender (Microsoft, accessed 26 October 2026); [19] Guided responses in Copilot in Defender (Microsoft, accessed 26 October 2026); [20] Security Copilot in Microsoft Entra (Microsoft, accessed 26 October 2026); [21] Microsoft Copilot in Intune (Microsoft, accessed 26 October 2026); [22] Security Copilot in Microsoft Purview (Microsoft, accessed 26 October 2026); [23] Security Copilot incident summaries in Sentinel (Microsoft, accessed 26 October 2026); [24] What is Microsoft Sentinel graph? (Microsoft, accessed 26 October 2026); [25] Application card for Security Copilot agents (Microsoft, accessed 26 October 2026)

Connect with me on LinkedIn.

A note on the process: I used AI to assist with research, drafting, editing and artwork. I checked claims against the linked Microsoft documentation. I did not test these capabilities in a live tenant; the recommendations and judgement are mine.