5.3.1. Workspaces, Permissions, and Roles
💡 First Principle: Security Copilot applies two independent permission checks — a Copilot role that decides who can use and administer the platform, and the user's existing Entra, Azure, and service roles that decide what any plugin can return for them. Neither layer can widen the other.
Configuring workspaces for Security Copilot: a workspace is a scoped, tenant-bound environment where users, automations, and agents operate. Each one has its own capacity (provisioned Security Compute Units, plus optional overage billed only when used), its own role assignments, workspace-level plugin and owner settings, and its own prompt history. Every tenant has a default workspace created at onboarding; organizations add more to separate teams, regions, or budgets. Attaching capacity requires Azure Owner or Contributor on the subscription or resource group plus Security Administrator (or higher) in the tenant.
Managing permissions and roles: Security Copilot has two roles of its own — Copilot owner and Copilot contributor — and they aren't Microsoft Entra roles. Contributors create sessions, run and share promptbooks, and (by default) upload files. Owners also control plugin availability and custom-plugin permissions, capacity, the usage dashboard, and data-sharing settings. Global Administrator, Security Administrator, Billing Administrator, Entra Compliance Administrator, and Intune Administrator (plus several Purview roles) inherit owner automatically, and Copilot always keeps at least two owners. New deployments grant contributor access through the Recommended Microsoft Security roles group rather than the older Everyone default. Assign Copilot roles to role-assignable security groups, and don't hand out Security Administrator just so someone can use Copilot.
⚠️ Exam Trap: Copilot uses on-behalf-of authentication — in Microsoft's words, it "doesn't go beyond the access you have." A Copilot owner with no Sentinel role still can't see Sentinel incidents through Copilot. When an analyst with full Sentinel access gets no Sentinel answers, look at the plugin: it may not be set up with the Sentinel workspace that holds the data, or an owner may have restricted it to owners only. No Copilot permission overrides or narrows Sentinel RBAC.
Reflection Question: A new analyst is added to the Copilot contributor role but holds no Sentinel or Defender roles. What will Copilot return when they ask about last night's incidents, and why is that the intended design?
