You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/sentinel/datalake/sentinel-mcp-data-exploration-tool.md
+9-6Lines changed: 9 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,7 +4,7 @@ titleSuffix: Microsoft Security
4
4
description: Learn about the different tools available in the Data exploration collection in Microsoft Sentinel
5
5
author: poliveria
6
6
ms.topic: how-to
7
-
ms.date: 04/08/2026
7
+
ms.date: 04/14/2026
8
8
ms.author: pauloliveria
9
9
ms.service: microsoft-sentinel
10
10
ms.subservice: sentinel-platform
@@ -35,11 +35,6 @@ To access the data exploration tool collection, you need the following prerequis
35
35
> - Security Contributor
36
36
> - Security Operator
37
37
> - Security Reader
38
-
>
39
-
> To use the entity analyzer tool, you also need the following roles:
40
-
> -**Security Copilot Contributor** – This role is required to use the tool, which consumes Security Compute Units (SCUs) to deliver reasoned entity risk analysis.
41
-
> -**Security Copilot Owner** (optional) – This role is only required to view and monitor SCU usage.
42
-
> For more information, see [Understand authentication in Microsoft Security Copilot](/copilot/security/authentication).
43
38
44
39
## Add the data exploration collection
45
40
@@ -90,6 +85,14 @@ For example, `analyze_user_entity` reasons over the user's authentication patter
90
85
91
86
Entity analysis tools might require a few minutes to generate results, so there are tools to start analysis for each entity and another one that polls for the analysis results.
92
87
88
+
> [!IMPORTANT]
89
+
> To use the entity analyzer tool, you also need the following roles:
90
+
> -**Security Copilot Contributor** – This role is required to use the tool, which consumes Security Compute Units (SCUs) to deliver reasoned entity risk analysis.
91
+
> -**Security Copilot Owner** (optional) – This role is only required to view and monitor SCU usage.
92
+
>
93
+
> For more information, see [Understand authentication in Microsoft Security Copilot](/copilot/security/authentication).
94
+
95
+
93
96
#### Start analysis (`analyze_user_entity` and `analyze_url_entity`)
0 commit comments