3.1.3. Agentic AI and Microsoft Security Copilot
💡 First Principle: Much of an analyst's time goes into reading: alert details, command lines, scripts, logs. Large language models are good at reading and summarizing, so Security Copilot is embedded where that reading happens. Agents go one step further and run a defined triage task end to end. In both cases the value is speed; the risk is unexamined trust, so the design keeps humans able to see, override, and correct the AI's work.
Embedded Security Copilot in the Defender portal appears as side-panel skills on the pages where you need them (it requires Security Copilot to be provisioned for the user, typically through Security Compute Units):
| Capability | Where it helps |
|---|---|
| Incident summary | Condenses the attack story, timeline, and impacted assets when you open an incident |
| Guided responses | Recommends triage, containment, investigation, and remediation actions for the incident |
| Script analysis | Explains what an obfuscated PowerShell or command line does |
| File analysis | Summarizes a file's behavior and detection information |
| Device and identity summaries | Profiles an asset's configuration, risk, and recent activity |
| Natural language to KQL | Drafts advanced hunting queries from a plain-language question |
| Incident report | Produces a written report of the response for stakeholders |
Defender Chat adds an open-prompt assistant that understands the page you're on ("which users are involved in this incident?") and proposes multi-step plans you approve before it acts.
Security Copilot agents run specific jobs autonomously within boundaries. The Phishing Triage Agent (also extended as a security alert triage agent to selected identity and cloud alerts) picks up alerts created when users report suspicious email, analyzes content, URLs, and attachments with detonation and threat intelligence, and returns a verdict: a false positive is resolved, while a true positive stays open for an analyst. Each verdict comes with a plain-language explanation and a visual map of the agent's workflow. Analysts can change the classification and give natural-language feedback that, once evaluated and approved, teaches the agent for future decisions. The agent runs under its own Microsoft Entra Agent ID (recommended) or a connected user account, with only the permissions it needs, and its activity, performance, and Security Compute Unit consumption are visible on the Agents page. Prerequisites include Defender for Office 365 Plan 2, the user-reported message alert policy turned on, and no alert tuning rule auto-resolving those alerts, because the agent doesn't triage tuned alerts.
⚠️ Exam Trap: "The Phishing Triage Agent isn't triaging user-reported phishing" often traces to an alert tuning rule (including the built-in auto-resolve rule for reported phish) resolving the alerts before the agent sees them. Disable the tuning rule; don't add more permissions.
Reflection Question: Why does Microsoft give a triage agent its own Entra agent identity rather than running it under an analyst's account? Connect your answer to least privilege and auditability.
