Microsoft Security Copilot experiences

Security Copilot offers an immersive standalone experience and intuitive embedded experiences that are available in other Microsoft security products.

In addition to the standalone and embedded experiences, Security Copilot offers developer scenarios that enable you to build, test, publish, and integrate agents and plugins to meet unique security needs. These scenarios empower developers to streamline workflows, automate tasks, and extend Security Copilot’s capabilities across Microsoft security products.

This topic helps you:

• Identify the differences between standalone and embedded Security Copilot experiences
• Explore available embedded experiences across Microsoft security solutions
• Find guidance for hiding or showing the Copilot sidecar panel
• Understand developer scenarios such as building custom agents and automating workflows with Security Copilot

Watch the following video to learn more about the Security Copilot experiences:

Standalone and embedded experiences

Standalone experience
Security Copilot, accessed through https://securitycopilot.microsoft.com, is considered the standalone experience.

Embedded experience
Accessing Security Copilot embedded experiences in other Microsoft security products is considered an embedded experience.

Important

Guidance on specific embedded experiences can be found in the documentation library of the corresponding service. For example, if you access a Microsoft Defender XDR embedded experience, then the corresponding documentation for that Security Copilot experience can be found in the Microsoft Defender XDR documentation. This ensures that you receive service-specific guidance wherever you access Security Copilot.

A feature common to all embedded experiences is the ability to hide or show the Copilot sidecar. The panel behavior persists per Copilot embedded experience, remembering that user's option. The embedded copilot functionality remains the same whether it's hidden or not, so closing the panel doesn't affect SCU consumption.

For example, to hide the Copilot in Microsoft Defender XDR experience, select the X. The incident summary will continue to generate in the background.

To make the panel visible again, select the Copilot button.

Embedded experiences

The following table lists the available embedded experiences.

Product	Embedded experience
Azure Firewall	- Enrich the threat profile of an IDPS signature beyond log information - Generate recommendations to secure your environment using Azure Firewall's IDPS feature - Look for a given IDPS signature across your tenant, subscription, or resource group - Retrieve the top IDPS signature hits for an Azure Firewall
Microsoft Defender for Cloud	- Analyze recommendations - Delegate recommendations - Remediate code - Remediate recommendations - Summarize recommendations
Microsoft Defender Threat Intelligence	- Using Security Copilot for threat intelligence
Microsoft Defender XDR	- Analyze files - Analyze scripts and codes - Create incident reports - Generate KQL queries for hunting - Summarize device information - Summarize incidents - Summarize identities - Use guided response
Microsoft Entra	- Investigate app risk - Investigate incidents - Investigate risky users - Manage lifecycle workflows
Microsoft Intune	- Device query - Policy and setting management - Use Microsoft Copilot in Intune to troubleshoot devices
Microsoft Purview	- Investigate a Microsoft Purview Data Loss Prevention alert - Investigate insider risk management activities - Summarize Communication Compliance messages by using Security Copilot - Summarize an eDiscovery message by using Security Copilot
Microsoft Sentinel	- Summarize Microsoft Sentinel incidents with Security Copilot

Developer scenarios

While Security Copilot offers immersive standalone and embedded experiences for end users, it also supports developer scenarios for organizations seeking to extend, automate, or integrate security workflows.

Developer scenarios empower you to:

• Build custom agents and plugins to automate security tasks
• Integrate Security Copilot with other Microsoft security products
• Build, publish, test and manage agents tailored to your organization's needs

Explore the Security Copilot Developer content.