Merge pull request #54500 from ceperezb/freshness-prince-refresh/security-copilot-describe-core-features-20260430

Taojunshen · web-flow · commit 76259eed912c · 2026-05-01T06:41:25.000+08:00
Freshness prince refresh/security copilot describe core features 20260430
diff --git a/learn-pr/wwl-sci/security-copilot-describe-core-features/1-introduction.yml b/learn-pr/wwl-sci/security-copilot-describe-core-features/1-introduction.yml
@@ -6,7 +6,7 @@ metadata:
   description: Describe the core features of Microsoft Security Copilot.
   author: wwlpublish
   ms.author: ceperezb
-  ms.date: 11/20/2024
+  ms.date: 04/30/2026
   ms.topic: unit
   ms.collection:
     - wwl-ai-copilot
diff --git a/learn-pr/wwl-sci/security-copilot-describe-core-features/2-describe-standalone-experience.yml b/learn-pr/wwl-sci/security-copilot-describe-core-features/2-describe-standalone-experience.yml
@@ -6,7 +6,7 @@ metadata:
   description: Describe the features available in the standalone experience of Microsoft Security Copilot
   author: wwlpublish
   ms.author: ceperezb
-  ms.date: 11/20/2024
+  ms.date: 04/30/2026
   ms.topic: unit
   ms.collection:
     - wwl-ai-copilot
diff --git a/learn-pr/wwl-sci/security-copilot-describe-core-features/2a-describe-session-features.yml b/learn-pr/wwl-sci/security-copilot-describe-core-features/2a-describe-session-features.yml
@@ -6,7 +6,7 @@ metadata:
   description: Describe the features available in a session of the standalone experience
   author: wwlpublish
   ms.author: ceperezb
-  ms.date: 11/20/2024
+  ms.date: 04/30/2026
   ms.topic: unit
   ms.collection:
     - wwl-ai-copilot
diff --git a/learn-pr/wwl-sci/security-copilot-describe-core-features/2b-describe-workspaces.yml b/learn-pr/wwl-sci/security-copilot-describe-core-features/2b-describe-workspaces.yml
@@ -6,7 +6,7 @@ metadata:
   description: Describe workspaces.
   author: wwlpublish
   ms.author: ceperezb
-  ms.date: 03/27/2025
+  ms.date: 04/30/2026
   ms.topic: unit
   ms.collection:
     - wwl-ai-copilot
diff --git a/learn-pr/wwl-sci/security-copilot-describe-core-features/3-describe-microsoft-plugins.yml b/learn-pr/wwl-sci/security-copilot-describe-core-features/3-describe-microsoft-plugins.yml
@@ -6,7 +6,7 @@ metadata:
   description: Describe the Microsoft plugins available in Microsoft Security Copilot.
   author: wwlpublish
   ms.author: ceperezb
-  ms.date: 11/20/2024
+  ms.date: 04/30/2026
   ms.topic: unit
   ms.collection:
     - wwl-ai-copilot
diff --git a/learn-pr/wwl-sci/security-copilot-describe-core-features/4-describe-non-microsoft-plugins.yml b/learn-pr/wwl-sci/security-copilot-describe-core-features/4-describe-non-microsoft-plugins.yml
@@ -6,7 +6,7 @@ metadata:
   description: Describe the non-Microsoft plugins supported by Microsoft Security Copilot.
   author: wwlpublish
   ms.author: ceperezb
-  ms.date: 11/20/2024
+  ms.date: 04/30/2026
   ms.topic: unit
   ms.collection:
     - wwl-ai-copilot
diff --git a/learn-pr/wwl-sci/security-copilot-describe-core-features/5-describe-custom-promptbooks.yml b/learn-pr/wwl-sci/security-copilot-describe-core-features/5-describe-custom-promptbooks.yml
@@ -6,7 +6,7 @@ metadata:
   description: Learn about custom promptbooks and how you can create them.
   author: wwlpublish
   ms.author: ceperezb
-  ms.date: 11/20/2024
+  ms.date: 04/30/2026
   ms.topic: unit
   ms.collection:
     - wwl-ai-copilot
diff --git a/learn-pr/wwl-sci/security-copilot-describe-core-features/5a-describe-knowledge-base-connections.yml b/learn-pr/wwl-sci/security-copilot-describe-core-features/5a-describe-knowledge-base-connections.yml
@@ -6,7 +6,7 @@ metadata:
   description: Learn about knowledge base connections and how to integrate as an additional source of information for your organization.
   author: wwlpublish
   ms.author: ceperezb
-  ms.date: 11/20/2024
+  ms.date: 04/30/2026
   ms.topic: unit
   ms.collection:
     - wwl-ai-copilot
diff --git a/learn-pr/wwl-sci/security-copilot-describe-core-features/6-knowledge-check.yml b/learn-pr/wwl-sci/security-copilot-describe-core-features/6-knowledge-check.yml
@@ -6,7 +6,7 @@ metadata:
   description: Describe the core features of Microsoft Security Copilot.
   author: wwlpublish
   ms.author: ceperezb
-  ms.date: 11/20/2024
+  ms.date: 04/30/2026
   ms.topic: unit
   ms.collection:
     - wwl-ai-copilot
@@ -48,7 +48,7 @@ quiz:
     choices:
     - content: Select the My sessions option from the home menu.
       isCorrect: true
-      explanation: Correct. My sessions allows users to manage and review past sessions with options to search, filter, rename, duplicate, or delete.
+      explanation: Correct. My sessions allow users to manage and review past sessions with options to search, filter, rename, duplicate, or delete.
     - content: Select the Help icon.
       isCorrect: false
       explanation: Incorrect. Help provides assistance and information about using the platform, not past session management.
diff --git a/learn-pr/wwl-sci/security-copilot-describe-core-features/7-summary.yml b/learn-pr/wwl-sci/security-copilot-describe-core-features/7-summary.yml
@@ -6,7 +6,7 @@ metadata:
   description: Describe the core features of Microsoft Security Copilot.
   author: wwlpublish
   ms.author: ceperezb
-  ms.date: 11/20/2024
+  ms.date: 04/30/2026
   ms.topic: unit
   ms.collection:
     - wwl-ai-copilot
diff --git a/learn-pr/wwl-sci/security-copilot-describe-core-features/includes/2-describe-standalone-experience.md b/learn-pr/wwl-sci/security-copilot-describe-core-features/includes/2-describe-standalone-experience.md
@@ -39,11 +39,11 @@ From the home menu, the user can navigate as follows:
 
   - Owner settings. These settings include the option to switch Security Compute Units (SCUs) capacity, select the workspace for Copilot agents, configure data sharing options to help improve Copilot, allow logging audit data in Microsoft Purview, and configure who can upload files.
 
-    # [Swtich capacity](#tab/switch-capacity)
+    # [Switch capacity](#tab/switch-capacity)
     :::image type="content" source="../media/owner-settings-capacity.png" lightbox="../media/owner-settings-capacity.png" alt-text="Screen capture showing the owner settings, specifically focused on capacity information.":::
 
     # [Agent workspaces](#tab/agent-worksapces)
-    :::image type="content" source="../media/agent-workspaces.png" lightbox="../media/agent-workspaces.png" alt-text="Screen capture showing the workspace that will be used for Security Copilot agent experiences in Microsoft Defender, Microsoft Entra, Microsoft Purview and Microsoft Intune.":::
+    :::image type="content" source="../media/agent-workspaces.png" lightbox="../media/agent-workspaces.png" alt-text="Screen capture showing the workspace that will be used for Security Copilot agent experiences in Microsoft Defender, Microsoft Entra, Microsoft Purview, and Microsoft Intune.":::
 
     # [Improve Copilot](#tab/improve-copilot)
     :::image type="content" source="../media/owner-settings-improve-copilot.png" lightbox="../media/owner-settings-improve-copilot.png" alt-text="Screen capture showing the owner settings, specifically focused on data sharing options.":::
@@ -83,9 +83,9 @@ From the home menu, the user can navigate as follows:
   
        :::image type="content" source="../media/workspace-manage-v2.png" lightbox="../media/workspace-manage-v2.png" alt-text="A screenshot of the manage workspaces page that lists the available workspaces.":::
 
-  - Usage monitoring, which provides a dashboard showing how SCUs are consumed over a period of time by your Microsoft Security Copilot workloads. The usage monitoring dashboard provides visibility, for a selected workspace, into the number of units used, the specific plugins employed during sessions, and the initiators of those sessions. The dashboard also allows you to apply filters and export usage data seamlessly. The dashboard includes up to 90 days of data. When an analyst is in the middle of an investigation and the usage is nearing the provisioned capacity limit (90%), a notification is displayed to the analyst while entering the prompt. The notification informs the analyst to contact the owner to increase the capacity or limit the number of prompts to avoid disruptions. These notifications are also shown in the Security Copilot embedded experiences.
+  - Usage monitoring, which provides a dashboard showing how SCUs are consumed over a period of time by your Microsoft Security Copilot workloads. The usage monitoring dashboard provides visibility, for a selected workspace, into the number of units used, the specific plugins employed during sessions, and the initiators of those sessions. The dashboard also allows you to apply filters and export usage data seamlessly. The dashboard includes up to 90 days of data. Security Copilot supports both provisioned SCUs for predictable workloads and overage SCUs that provide flexible, on-demand capacity billed only when used. Overage SCUs ensure additional capacity is available when initially provisioned units are depleted during unexpected workload spikes. When an analyst is in the middle of an investigation and the usage is nearing the provisioned capacity limit (90%), a notification is displayed to the analyst while entering the prompt. The notification informs the analyst to contact the owner to increase the capacity or limit the number of prompts to avoid disruptions. These notifications are also shown in the Security Copilot embedded experiences.
   
-    When the provisioned capacity is crossed, the analyst sees an error message stating that due to high usage in organization, they cannot submit additional prompts. The analyst is asked to contact the owner to increase the provisioned SCUs.
+    When the provisioned capacity is crossed, the analyst sees an error message stating that due to high usage in the organization, they can't submit additional prompts. The analyst is asked to contact the owner to increase the provisioned SCUs.
 
     # [Usage monitoring](#tab/usage-monitoring)
     :::image type="content" source="../media/usage-monitoring-dashboard-new.png" lightbox="../media/usage-monitoring-dashboard-new.png" alt-text="Screen capture showing the usage monitoring dashboard.":::
@@ -134,7 +134,7 @@ Selecting the ellipses on the bottom left corner of the navigation panel, allows
     ---
 
 
-- Tenant switcher. The tenant, which is provisioned for Copilot doesn't need to be the tenant your security analyst logs in from.  Also a user may have access to Security Copilot across multiple tenants. In the screenshot that follows, the user is provisioned only in the "Zava - Private" tenant. If the user had been provisioned in other tenants, they would be listed and the user would be able to select any of the available tenants.
+- Tenant switcher. The tenant, which is provisioned for Copilot doesn't need to be the tenant your security analyst logs in from. Also a user may have access to Security Copilot across multiple tenants. In the screenshot that follows, the user is provisioned only in the "Zava - Private" tenant. If the user had been provisioned in other tenants, they would be listed and the user would be able to select any of the available tenants.
 
     :::image type="content" source="../media/tenant-switcher-v4.png" lightbox="../media/tenant-switcher-v4.png" alt-text="Screen capture showing the tenant switching window, with multiple tenants listed.":::
 
diff --git a/learn-pr/wwl-sci/security-copilot-describe-core-features/includes/2a-describe-session-features.md b/learn-pr/wwl-sci/security-copilot-describe-core-features/includes/2a-describe-session-features.md
@@ -9,7 +9,7 @@ Copilot has features that are common across all sessions and the individual prom
 
 ### Process log
 
-For every prompt Copilot runs, Copilot generates a process log that is visible to the user. The user can see what capability is used to generate the response. This is important because it enables the user to determine whether the response was generated from a trusted source. In the screenshot that follows, the process log shows that Copilot chose the Incident Analysis capability. The process log also shows that the final output went through safety checks, which is part of Microsoft’s commitment to responsible AI.
+For every prompt Copilot runs, Copilot generates a process log that's visible to the user. The user can see what capability is used to generate the response. This is important because it enables the user to determine whether the response was generated from a trusted source. In the screenshot that follows, the process log shows that Copilot chose the Incident Analysis capability. The process log also shows that the final output went through safety checks, which is part of Microsoft’s commitment to responsible AI.
 
 :::image type="content" source="../media/process-log-new.png" lightbox="../media/process-log-new.png" alt-text="Screen capture showing process log, which shows the selected skill and that a safety check was run on the composed message.":::
 
diff --git a/learn-pr/wwl-sci/security-copilot-describe-core-features/includes/2b-describe-workspaces.md b/learn-pr/wwl-sci/security-copilot-describe-core-features/includes/2b-describe-workspaces.md
@@ -1,4 +1,4 @@
-Copilot workspaces are separate work environments within the tenant in which your Copilot instance is operating.
+Copilot workspaces are separate work environments within the tenant in which your Copilot instance is operating. Workspaces were designed to give customers the ability to create segmentation for agentic traffic and help teams manage resources, optimize workflows, and maintain compliance with organizational policies.
 
 To help you better understand the concept of workspaces, we use the analogy of house with multiple rooms. Each room is configured to be optimized for its function and the people that use that room. When someone enters the house, they might have access to some rooms but not others.
 
diff --git a/learn-pr/wwl-sci/security-copilot-describe-core-features/includes/3-describe-microsoft-plugins.md b/learn-pr/wwl-sci/security-copilot-describe-core-features/includes/3-describe-microsoft-plugins.md
diff --git a/learn-pr/wwl-sci/security-copilot-describe-core-features/includes/5-describe-custom-promptbooks.md b/learn-pr/wwl-sci/security-copilot-describe-core-features/includes/5-describe-custom-promptbooks.md
diff --git a/learn-pr/wwl-sci/security-copilot-describe-core-features/includes/5a-describe-knowledge-base-connections.md b/learn-pr/wwl-sci/security-copilot-describe-core-features/includes/5a-describe-knowledge-base-connections.md
diff --git a/learn-pr/wwl-sci/security-copilot-describe-core-features/index.yml b/learn-pr/wwl-sci/security-copilot-describe-core-features/index.yml
