Security Copilot relies on this OAuth flow so that a plugin never exceeds what the signed-in user may see. As a result, users need data roles too, Microsoft Sentinel Reader for example.
Also called OBO.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains On-behalf-of authentication in context, with comparison tables and the common traps.
Terms in this definition
- Microsoft Security Copilot
Security assistant powered by generative AI, used in its own portal or embedded in Intune, Entra, Defender and Purview, and extensible with agents and plugins.
- OAuth
An authorisation standard allowing software to act for someone. In Azure Pipelines, choosing it for a GitHub service connection ties the connection to your own GitHub account; for integrations with Azure DevOps APIs, Microsoft Entra ID OAuth is the right choice.
- Flow
The unit of work inside a Lakeflow pipeline that takes data from a source, transforms it and lands it in a destination like a streaming table. Streaming flows either append or update, and
CREATE FLOWlets you declare a flow apart from the table it feeds. - Security Copilot plugin
Lets Security Copilot reach a data source, whether Microsoft, third-party or custom. Users still need their own permissions on that source for it to return anything.
- Chat message roles
Labels on chat messages: instructions go under system, the person's input under user, the model's previous answers under assistant, and results returned by a called tool under tool (or function).
- Microsoft Sentinel Reader
Built-in Azure role for viewing incidents, workbooks and data in Sentinel; it can't change incidents.