A risky AI use alert gets an owner
The sample response names who reviews and who may act.
Coming
See every demonstrationSECURITY COPILOT FOR SECOPS
Put Security Copilot on Sentinel so analysts decide instead of transcribe.
Your analysts spend more of each incident writing queries and assembling summaries than deciding what to do, and the post-incident review found that investigation time, not detection, let the intrusion persist. We size the Security Compute Units against your real incident volume, configure the plugins across Sentinel, Defender XDR, Entra, Purview and threat intelligence, build a promptbook library on your own table schema, and train the team on your own incidents.
01 Source02 Boundary03 Human decision04 Evidence
HOW IT WORKS
The control path in practice.
- Size the Security Compute Units against actual incident and hunting volume, with a provisioning plan that avoids both over-provisioning and throttling.
- Configure the plugins across Microsoft Sentinel, Defender XDR, Microsoft Entra, Microsoft Purview and Defender Threat Intelligence, plus the supported non-Microsoft plugins you use.
- Build the promptbook library: incident summarization, reverse-engineering of endpoint scripts, query generation for your table schema, and the executive incident brief, stored and version-controlled in your tenant.
- Run two live analyst workshops on your own incidents and record the measurement baseline.
THE PROBLEM
Why do most Security Copilot projects stop at a demo?
Because provisioning is easy and the work is in the sizing, the plugins, the promptbooks and the habits. A capacity commitment sized by guess either throttles the team or pays for compute nobody uses, and a promptbook written for a generic schema returns generic answers.
The program measures incident and hunting volume first, provisions against it, and writes the promptbooks against your table schema, so the first week of use is on your incidents and the measurement baseline exists before anyone claims an improvement.
THE MICROSOFT INSIGHT
Is Security Copilot already in your license?
Microsoft Security Copilot is included for eligible Microsoft 365 E5 and E7 customers; the rollout started November 18, 2025 and continues in phases, so the sizing conversation starts with what the license already carries before any capacity is bought.
Microsoft Security Copilot is included for eligible Microsoft 365 E5 and E7 customers; the rollout started November 18, 2025 and continues in phases. (Microsoft Learn, checked Oct 31, 2026)
Check the entitlement first and the Security Compute Unit plan buys only what the license does not cover. Skip it and the plan pays twice.
THE METHOD
What does the program deliver?
Sizing, plugins, promptbooks and enablement, each with a measurement baseline.
- Security Compute Unit sizing against actual incident and hunting volume, with a provisioning plan.
- Plugin configuration across Sentinel, Defender XDR, Entra, Purview and Defender Threat Intelligence, plus supported non-Microsoft plugins.
- A promptbook library for incident summarization, endpoint script reverse-engineering, query generation on your schema and the executive incident brief, version-controlled in your tenant.
- Two live analyst workshops on your own incidents, and a baseline to measure time per incident against.
THE DEADLINE
Why does the Sentinel portal matter to this plan?
After March 31, 2027 Microsoft Sentinel is no longer supported in the Azure portal and is available only in the Microsoft Defender portal, so the promptbooks and the analyst habits are built in the Defender portal from the start rather than migrated later.
After March 31, 2027, Microsoft Sentinel is no longer supported in the Azure portal and is available only in the Microsoft Defender portal. (Microsoft Learn, checked Oct 31, 2026)
Build the habits in the portal that stays and the retirement date passes unnoticed. Build them in the portal that goes and the retirement date is a second project.
WHAT IT IS NOT
Does the program include the ongoing compute?
No. Ongoing Security Compute Unit consumption is billed by Microsoft; custom plugin development against non-Microsoft tools is scoped separately; and regional availability is confirmed in scoping. Prerequisites are an existing Sentinel workspace and Defender XDR with at least sixty days of telemetry and an Azure subscription able to provision the units.
Access is Global Administrator plus Security Administrator consent, with a named SOC lead for both workshops. Security Copilot is provisioned in your tenant against capacity in the Azure region you choose, the promptbooks are stored and version-controlled in your tenant, and owner and contributor roles are mapped to Entra security groups.
AFTER TWO WEEKS
What will be working after two weeks?
- Your Security Compute Units are sized against measured incident and hunting volume, with a provisioning plan.
- The plugins are configured across Sentinel, Defender XDR, Entra, Purview and threat intelligence, and the non-Microsoft ones you use.
- Your analysts hold a promptbook library on your own table schema, version-controlled in your tenant.
- Two workshops have run on your own incidents and the time-per-incident baseline is recorded.
The work is delivered remotely inside your own Microsoft tenant, wherever your business is, and on site only when the work needs it.
HONEST ABOUT LIMITS
What this does not do yet
It does not give an E5 or E7 tenant a SIEM without a Sentinel workspace today. ISOC in Microsoft Defender, in preview, brings SIEM capabilities into the Defender portal for eligible Microsoft 365 E5 and E7 customers without an active Microsoft Sentinel workspace, with 30 days of included retention for Defender data during this preview phase. (Microsoft Learn, checked Oct 31, 2026, preview) ISOC in Microsoft Defender, which brings SIEM capabilities into the Defender portal for eligible E5 and E7 customers without an active Sentinel workspace, is in preview; the program assumes an existing Sentinel workspace and labels ISOC as a candidate for the next review.
It does not pay for ongoing compute; Microsoft bills the units you consume.
It does not build custom plugins for non-Microsoft tools; that is scoped separately.
THE ONE THING TO REMEMBER
Size to the incidents you have, write the promptbooks on the schema you have, measure before you claim.
Said another way: entitlement, sizing, plugins, promptbooks, workshops, baseline.
Said a third way: the analyst who stops transcribing starts deciding, and the baseline shows by how much.
SHOW YOUR WORK
See the control path on a fictional bank.
DIRECT ANSWERS
Questions before you decide.
What do we need in place?
An existing Microsoft Sentinel workspace and Defender XDR with at least sixty days of telemetry, an Azure subscription that can provision Security Compute Units, and a named SOC lead for the two workshops.
Who pays for the compute?
Microsoft bills the Security Compute Units you consume on your Azure subscription. The program sizes them to your volume so the commitment is neither throttled nor idle.
Where is it sold?
On Azure Marketplace, bought through the Azure portal and billed on your existing Microsoft agreement; private offers on request. Plans and terms are on the listing. No price appears on this site.
What is the relationship to Managed Security?
Managed Security runs the response under an authority you wrote down; this program equips your own analysts. Many firms do the second first and decide on the first afterward.
NEXT STEP
Start with a boundary you can explain.
Choose a focused check, or speak with the team about the workflow you need to improve.
Buy through Microsoft Marketplace Bought through the Azure portal and billed on your Microsoft agreement; plans and terms are on the listing.