Microsoft Security Copilot Agents

Security Copilot agents are purpose-built, semi-autonomous AI agents that operate within Security Copilot to take on high-volume security workflows, learn from analyst feedback, and act inside the Microsoft Security products. Each agent has its own Entra Agent ID, scoped permissions, and a supervision model.

When to use

Use this skill when the user wants to offload a high-volume, repetitive triage or remediation workflow to an agent and is ready to govern an autonomous workload identity.

Do not use this skill for:

• Basic Security Copilot setup, SCU provisioning, promptbooks (use security-copilot)
• General Entra Agent ID design (use entra-id + Entra Agent ID guidance)
• Building a custom agent from scratch (this skill is operating built-in agents)

Pick the right agent for the job