An AI agent, configured by a Security Copilot owner or contributor, that carries out Copilot workflows when its trigger fires, acting under the identity it has been given.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Security Copilot agent in context, with comparison tables and the common traps.
Terms in this definition
- AI agent
Software pairing a generative model with tools, enabling it to understand what is asked, converse and act to reach a goal.
- Security Copilot Owner
Role within Security Copilot, separate from Entra roles, covering settings, plugins, role assignments and capacity, yet giving no access to security data. Global Administrators and Security Administrators receive it automatically.
- Contributor
Built-in Azure role with full management of resources, except that it can't give access to anyone.
- Azure Functions trigger
Every function is started by exactly one thing. That thing might be a web call over HTTP, a schedule, the arrival of a blob, a message landing in a queue or a change in a database.
- IDENTITY
A column property, written IDENTITY(seed, increment), that gives each new row the next number in a rising sequence. SCOPE_IDENTITY reports the latest value created in the current scope, and a rolled-back transaction still uses up the numbers it took.
Related terms
- Alert Triage Agent
A preview Security Copilot agent that sorts DLP alerts for you, weighing the risk each one carries and placing it in groups like Needs attention or Less urgent. Running it uses security compute units.
- Data Security Posture Agent
Lets admins ask questions in plain language across Exchange, Teams, SharePoint, OneDrive and Copilot interactions for quick checks before an investigation. It is a Security Copilot agent in preview inside the current DSPM and uses security compute units.
- Microsoft Entra agentic identity
When a Security Copilot agent runs in Intune it gets an agentic user, its own identity in Microsoft Entra, so it works with delegated permissions of its own and not those of the admin.
- Phishing Triage Agent
Security Copilot agent within the Defender portal that sorts phishing alerts reported by users. Setting it up, pausing or removing it requires Security Administrator.
- Vulnerability Remediation Agent
A preview Security Copilot agent in Intune. Drawing on Defender Vulnerability Management data, it ranks CVEs by importance and proposes how to fix them.