Microsoft Security Copilot (Preview)
A generative AI-powered assistant for daily operations in security and IT. AI-generated content may be incorrect. Check it for accuracy.
This connector is available in the following products and regions:
| Service | Class | Regions |
|---|---|---|
| Copilot Studio | Standard | All Power Automate regions except the following: - US Government (GCC) - US Government (GCC High) - China Cloud operated by 21Vianet - US Department of Defense (DoD) |
| Logic Apps | Standard | All Logic Apps regions except the following: - Azure Government regions - Azure China regions - US Department of Defense (DoD) |
| Power Apps | Standard | All Power Apps regions except the following: - US Government (GCC) - US Government (GCC High) - China Cloud operated by 21Vianet - US Department of Defense (DoD) |
| Power Automate | Standard | All Power Automate regions except the following: - US Government (GCC) - US Government (GCC High) - China Cloud operated by 21Vianet - US Department of Defense (DoD) |
| Contact | |
|---|---|
| Name | Microsoft |
| URL | Microsoft LogicApps Support Microsoft Power Automate Support Microsoft Power Apps Support |
| Connector Metadata | |
|---|---|
| Publisher | Microsoft |
Microsoft Security Copilot
Pre-Requisites
To make the most of this new Logic App connector, there are a few prerequisites to be aware of
Tenant deployment requirements: Your Logic App must be deployed within a tenant that is actively participating in the Security Copilot Early Access Program
User authentication and role access: Users looking to authenticate with the Logic App connector must hold specific access roles. For a deeper understanding of these roles and how they function within the framework of Security Copilot, we recommend exploring Understand authentication in Microsoft Security Copilot | Microsoft Learn
Data access for enhanced security interaction: It's important that the authenticated user can access data from various remote security products. This encompasses tasks like reading Defender incident reports and gathering multi-factor authentication (MFA) details, among others.
For access to Microsoft Security Copilot Early Access Program, reference the following onboarding documentation
Authentication
The Microsoft Security Copilot connector can operate on behalf of a Entra (AAD) user identity that has the necessary permissions to call Security Copilot.
Available resources
Security Copilot Connector
Azure Logic Apps
Creating a connection
The connector supports the following authentication types:
| Oauth | Provide Microsoft Entra ID credentials | All regions | Not shareable |
| Service principal authentication | Use your own Microsoft Entra ID app for service principal authentication. | only | Not shareable |
| Default [DEPRECATED] | This option is only for older connections without an explicit authentication type, and is only provided for backward compatibility. | All regions | Not shareable |
Oauth
Auth ID: Oauth
Applicable: All regions
Provide Microsoft Entra ID credentials
This is not shareable connection. If the power app is shared with another user, another user will be prompted to create new connection explicitly.
Service principal authentication
Auth ID: OauthServicePrincipal
Applicable: only
Use your own Microsoft Entra ID app for service principal authentication.
This is not shareable connection. If the power app is shared with another user, another user will be prompted to create new connection explicitly.
| Name | Type | Description | Required |
|---|---|---|---|
| Client ID | string | True | |
| Client Secret | securestring | True | |
| Tenant | string | True |
Default [DEPRECATED]
Applicable: All regions
This option is only for older connections without an explicit authentication type, and is only provided for backward compatibility.
This is not shareable connection. If the power app is shared with another user, another user will be prompted to create new connection explicitly.
Throttling Limits
| Name | Calls | Renewal Period |
|---|---|---|
| API calls per connection | 600 | 60 seconds |
Actions
| Fetch prompt status |
Fetch the evaluation status |
| Fetch promptbookprompt evaluation status |
Fetch promptbookprompt evaluation status |
| Submit a Security Copilot prompt |
Submit a security question or task to Security Copilot and get a response. AI-generated content may contain mistakes. Check responses for accuracy. |
Fetch prompt status
Fetch the evaluation status
Parameters
| Name | Key | Required | Type | Description |
|---|---|---|---|---|
|
Evaluation Id
|
evaluationId | True | string |
Id of evaluation being fetched |
|
Session Id
|
sessionId | True | string |
Id of session in which evaluation was performed |
|
Prompt Id
|
promptId | True | string |
Id of prompt evaluated |
Returns
Evaluation result object
- Body
- EvaluationResult
Fetch promptbookprompt evaluation status
Fetch promptbookprompt evaluation status
Parameters
| Name | Key | Required | Type | Description |
|---|---|---|---|---|
|
Session Id
|
sessionId | True | string |
Id of session in which evaluation was performed |
|
Prompt Id
|
promptId | True | string |
Id of prompt evaluated |
Returns
Promptbook run result object
- Body
- PromptbookRunResult
Submit a Security Copilot prompt
Submit a security question or task to Security Copilot and get a response. AI-generated content may contain mistakes. Check responses for accuracy.
Parameters
| Name | Key | Required | Type | Description |
|---|---|---|---|---|
|
Prompt Content
|
PromptContent | True | string |
Prompt to be evaluated by security copilot |
|
SessionId
|
SessionId | string |
The ID for an existing Copilot session |
|
|
Plugins
|
Skillsets | array of string |
Plugins to enable for this Copilot session |
|
|
Direct Skill Name
|
SkillName | string |
Skill to invoke |
|
|
Direct Skill Inputs
|
SkillInputs | object |
Skill required inputs |
Returns
Evaluation result object
- Body
- EvaluationResult
Definitions
EvaluationResult
Evaluation result object
| Name | Path | Type | Description |
|---|---|---|---|
|
sessionId
|
sessionId | string | |
|
promptId
|
promptId | string | |
|
evaluationId
|
evaluationId | string | |
|
skillName
|
skillName | string | |
|
promptContent
|
promptContent | string | |
|
evaluationState
|
evaluationState | string | |
|
evaluationResultType
|
evaluationResultType | string | |
|
EvaluationResultContent
|
EvaluationResultContent | string | |
|
nextPromptSuggestions
|
nextPromptSuggestions | array of string |
PromptbookPromptEvaluationResult
Promptbook prompt evaluation result object
| Name | Path | Type | Description |
|---|---|---|---|
|
skillName
|
skillName | string | |
|
promptContent
|
promptContent | string | |
|
evaluationResultType
|
evaluationResultType | string | |
|
EvaluationResultContent
|
EvaluationResultContent | string |
PromptbookRunResult
Promptbook run result object
| Name | Path | Type | Description |
|---|---|---|---|
|
sessionId
|
sessionId | string | |
|
promptbookState
|
promptbookState | string | |
|
evaluationResults
|
evaluationResults | array of PromptbookPromptEvaluationResult |