Merge pull request #54506 from ceperezb/CEPEREZB-sc5006-security-copilot-embedded

JillGrant615 · web-flow · commit 9105a2afc82c · 2026-04-30T21:41:09.000-06:00
update module
diff --git a/learn-pr/wwl-sci/security-copilot-embedded-experiences/1-introduction.yml b/learn-pr/wwl-sci/security-copilot-embedded-experiences/1-introduction.yml
@@ -6,7 +6,7 @@ metadata:
   description: Describe the embedded experiences of Microsoft Security Copilot.
   author: wwlpublish
   ms.author: ceperezb
-  ms.date: 11/20/2024
+  ms.date: 04/30/2026
   ms.topic: unit
   ms.collection:
     - wwl-ai-copilot
diff --git a/learn-pr/wwl-sci/security-copilot-embedded-experiences/2-copilot-for-defender.yml b/learn-pr/wwl-sci/security-copilot-embedded-experiences/2-copilot-for-defender.yml
@@ -6,10 +6,10 @@ metadata:
   description: Describe Copilot in Microsoft Defender XDR.
   author: wwlpublish
   ms.author: ceperezb
-  ms.date: 11/20/2024
+  ms.date: 04/30/2026
   ms.topic: unit
   ms.collection:
     - wwl-ai-copilot
-durationInMinutes: 9
+durationInMinutes: 14
 content: |
   [!include[](includes/2-copilot-for-defender.md)]
diff --git a/learn-pr/wwl-sci/security-copilot-embedded-experiences/3-copilot-for-purview.yml b/learn-pr/wwl-sci/security-copilot-embedded-experiences/3-copilot-for-purview.yml
@@ -6,10 +6,10 @@ metadata:
   description: Copilot in Microsoft Purview.
   author: wwlpublish
   ms.author: ceperezb
-  ms.date: 11/20/2024
+  ms.date: 04/30/2026
   ms.topic: unit
   ms.collection:
     - wwl-ai-copilot
-durationInMinutes: 10
+durationInMinutes: 8
 content: |
   [!include[](includes/3-copilot-for-purview.md)]
diff --git a/learn-pr/wwl-sci/security-copilot-embedded-experiences/4-copilot-for-entra.yml b/learn-pr/wwl-sci/security-copilot-embedded-experiences/4-copilot-for-entra.yml
@@ -6,10 +6,10 @@ metadata:
   description: Copilot in Microsoft Entra.
   author: wwlpublish
   ms.author: ceperezb
-  ms.date: 11/20/2024
+  ms.date: 04/30/2026
   ms.topic: unit
   ms.collection:
     - wwl-ai-copilot
-durationInMinutes: 10
+durationInMinutes: 6
 content: |
   [!include[](includes/4-copilot-for-entra.md)]
diff --git a/learn-pr/wwl-sci/security-copilot-embedded-experiences/5-copilot-for-intune.yml b/learn-pr/wwl-sci/security-copilot-embedded-experiences/5-copilot-for-intune.yml
@@ -6,10 +6,10 @@ metadata:
   description: Copilot in Microsoft Intune.
   author: wwlpublish
   ms.author: ceperezb
-  ms.date: 11/20/2024
+  ms.date: 04/30/2026
   ms.topic: unit
   ms.collection:
     - wwl-ai-copilot
-durationInMinutes: 10
+durationInMinutes: 5
 content: |
   [!include[](includes/5-copilot-for-intune.md)]
diff --git a/learn-pr/wwl-sci/security-copilot-embedded-experiences/5a-copilot-for-defender-cloud.yml b/learn-pr/wwl-sci/security-copilot-embedded-experiences/5a-copilot-for-defender-cloud.yml
@@ -1,12 +1,12 @@
 ### YamlMime:ModuleUnit
 uid: learn.security-copilot-embedded-experiences.copilot-for-defender-cloud
-title: Copilot in Microsoft Defender for Cloud (Preview)
+title: Copilot in Microsoft Defender for Cloud
 metadata:
-  title: Copilot in Microsoft Defender for Cloud (Preview)
+  title: Copilot in Microsoft Defender for Cloud
   description: Copilot in Microsoft Defender for Cloud.
   author: wwlpublish
   ms.author: ceperezb
-  ms.date: 11/20/2024
+  ms.date: 04/30/2026
   ms.topic: unit
   ms.collection:
     - wwl-ai-copilot
diff --git a/learn-pr/wwl-sci/security-copilot-embedded-experiences/6-knowledge-check.yml b/learn-pr/wwl-sci/security-copilot-embedded-experiences/6-knowledge-check.yml
@@ -6,7 +6,7 @@ metadata:
   description: Check your knowledge on the embedded experiences of Microsoft Security Copilot.
   author: wwlpublish
   ms.author: ceperezb
-  ms.date: 11/20/2024
+  ms.date: 04/30/2026
   ms.topic: unit
   ms.collection:
     - wwl-ai-copilot
@@ -39,7 +39,7 @@ quiz:
     - content: The organization needs to be licensed for Microsoft Purview eDiscovery (Standard), as a minimum.
       isCorrect: false
       explanation: Incorrect. To use Security Copilot functionality with Microsoft Purview eDiscovery, the organization must be licensed for Microsoft Purview eDiscovery (Premium).
-  - content: After enabling the Entra plugin in Copilot and assigning the appropriate role permissions, an admin navigates to the Risky users report to investigate a user's risky sign-ins. What should the admin do next to view the Copilot generated summary?
+  - content: After enabling the Microsoft Entra plugin in Copilot and assigning the appropriate role permissions, an admin navigates to the Risky users report to investigate a user's risky sign-ins. What should the admin do next to view the Copilot generated summary?
     choices:
     - content: Select the 'Export' option to download the user's risk details.
       isCorrect: false
@@ -61,7 +61,7 @@ quiz:
     - content: Information about individual settings, their impact, and recommended values.
       isCorrect: true
       explanation: Correct. When creating a new policy, Copilot can be used to learn more about individual settings, their impact, and recommended values.
-  - content: Copilot in Defender for Cloud is available for all users when you enable Defender for Cloud in your environment, have access to Azure Copilot, and have SCUs assigned for Security Copilot. What additional requirement must be met to remediate code with Security Copilot?
+  - content: Copilot in Defender for Cloud is available for all users when you enable Defender for Cloud in your environment, have access to Azure Copilot, and have Security Compute Units (SCUs) assigned for Security Copilot. What additional requirement must be met to remediate code with Security Copilot?
     choices:
     - content: You must enable all the cloud workload protection plans.
       isCorrect: false
diff --git a/learn-pr/wwl-sci/security-copilot-embedded-experiences/7-summary.yml b/learn-pr/wwl-sci/security-copilot-embedded-experiences/7-summary.yml
@@ -6,7 +6,7 @@ metadata:
   description: Summary and resources on the embedded experiences of Microsoft Security Copilot.
   author: wwlpublish
   ms.author: ceperezb
-  ms.date: 11/20/2024
+  ms.date: 04/30/2026
   ms.topic: unit
   ms.collection:
     - wwl-ai-copilot
diff --git a/learn-pr/wwl-sci/security-copilot-embedded-experiences/includes/1-introduction.md b/learn-pr/wwl-sci/security-copilot-embedded-experiences/includes/1-introduction.md
@@ -1,4 +1,4 @@
-Microsoft Security Copilot is accessible directly from some Microsoft security products. This solution is referred to as the embedded experience. Currently, Copilot is embedded with Microsoft Defender XDR and Microsoft Purview, with more Microsoft security solutions embedding Copilot capabilities in the near term.
+Microsoft Security Copilot is accessible directly from some Microsoft security products. This solution is referred to as the embedded experience. Copilot is embedded with Microsoft Defender XDR, Microsoft Purview, Microsoft Entra, Microsoft Intune, Microsoft Defender for Cloud, and other Microsoft security solutions.
 
 The Microsoft solution in which the Copilot capabilities are embedded determines the scenarios that are available through the embedded experiences. For example, in Microsoft Purview Communication Compliance, Copilot can provide a summary of a message and its attachments, in the context of the policy and classifier conditions that flagged the message.
 
diff --git a/learn-pr/wwl-sci/security-copilot-embedded-experiences/includes/2-copilot-for-defender.md b/learn-pr/wwl-sci/security-copilot-embedded-experiences/includes/2-copilot-for-defender.md
@@ -14,6 +14,7 @@ Security Copilot capabilities embedded in Microsoft Defender XDR include:
 - Incident reports
 - Analyze files
 - Device summary
+- Threat intelligence
 
 > [!NOTE]
 >The list of Copilot capabilities embedded in Microsoft Defender XDR is continually growing. This unit provides just a sampling of some of those Copilot capabilities. For more information, see documentation on Microsoft Defender XDR.
@@ -158,6 +159,14 @@ Similarly, Copilot in Microsoft Defender XDR can summarize identities.
 
 ---
 
+### Threat intelligence
+
+Copilot is embedded in the threat intelligence section of the Microsoft Defender portal, helping security teams make informed decisions by consolidating and summarizing threat intelligence data.
+
+From the threat intelligence page, you can ask Copilot to summarize relevant threats impacting your environment, prioritize threats based on your organization's exposure levels, or identify threat actor groups that may be targeting your industry. Copilot uses the Microsoft Defender Threat Intelligence plugin to surface this information and can generate summaries of threat analytics reports, intel profiles, and vulnerability disclosures—all in natural language.
+
+This capability is particularly useful for threat hunters and analysts who need broad situational awareness before diving into a specific incident investigation.
+
 ### Common functionality across key features
 
 There are some options that are common across the features of Copilot for Microsoft Defender XDR.
diff --git a/learn-pr/wwl-sci/security-copilot-embedded-experiences/includes/3-copilot-for-purview.md b/learn-pr/wwl-sci/security-copilot-embedded-experiences/includes/3-copilot-for-purview.md
@@ -5,6 +5,7 @@ Microsoft Security Copilot is now accessible from within Microsoft Purview data
 
 Some of the scenarios supported as part of the embedded experience include:
 
+- Gain insights about your data security posture (DSPM).
 - Gain comprehensive summary of Data Loss Prevention alerts.
 - Gain comprehensive summary of Insider Risk Management alerts.
 - Gain contextual summary of Communication Compliance policy matches.
@@ -24,7 +25,7 @@ Data security teams generally receive more data security alerts per day than the
 
 To summarize Data Loss Prevention alerts using Copilot:
 
-1. Sign in to the Microsoft Purview compliance portal or the new Microsoft Purview portal and select the Data Loss Prevention solution. 
+1. Sign in to the Microsoft Purview portal or the new Microsoft Purview portal and select the Data Loss Prevention solution. 
 1. Navigate to the alerts queue and select the alert you want to review.
 1. Select "Get a summary from Security Copilot."
 
@@ -38,7 +39,7 @@ To summarize Data Loss Prevention alerts using Copilot:
 
 To summarize Insider Risk Management alerts using Copilot, you follow similar steps as described for DLP. 
 
-You sign in to the Microsoft Purview compliance portal or the new Microsoft Purview portal and go to the Insider Risk Management solution. Navigate to the alerts queue to select the alert you want to review. Information about the alert and the option to summarize the alert are displayed.
+You sign in to the Microsoft Purview portal or the new Microsoft Purview portal and go to the Insider Risk Management solution. Navigate to the alerts queue to select the alert you want to review. Information about the alert and the option to summarize the alert are displayed.
 
 :::image type="content" source="../media/copilot-insider-risk-management-v2.png" lightbox="../media/copilot-insider-risk-management-v2.png" alt-text="Screen capture of an Insider Risk Management alerts page that shows the option to summarize an alert.":::
 
@@ -57,17 +58,17 @@ Reviewing communications is an integral part of protecting your organization’s
 
 Contextual Summarization currently supports trainable classifiers as context and contextual summaries are only eligible for messages and attachments with a combined length of 100 words or more.
 
-Before you get started, ensure you have proper licensing to access Communication Compliance and the appropriate role permissions for Copilot and Communication Compliance. To get contextual summaries in policies, you must have Communication Compliance or Communication Compliance Investigator Role. For Copilot, you need, as a minimum, the Entra Security operator or Copilot workspace contributor role.
+Before you get started, ensure you have proper licensing to access Communication Compliance and the appropriate role permissions for Copilot and Communication Compliance. To get contextual summaries in policies, you must have Communication Compliance or Communication Compliance Investigator Role. For Copilot, you need, as a minimum, the Microsoft Entra Security operator or Copilot workspace contributor role.
 
 To get started:
 
-1. Navigate to the Communication Compliance solution from the Microsoft Purview compliance portal or the new Microsoft Purview portal, then navigate to the Policies tab in Communication Compliance.
+1. Navigate to the Communication Compliance solution from the Microsoft Purview portal or the new Microsoft Purview portal, then navigate to the Policies tab in Communication Compliance.
 
 1. Navigate to a policy that uses trainable classifiers as part of the policy’s configurations and select a policy match to view message content.
 
 1. A Copilot action button appears in the upper left command bar or a Summarize action button in the lower right command bar. Select either action to generate a contextual summary of the message and supported attachments.
 
-    :::image type="content" source="../media/copilot-communication-compliance-v2.png" lightbox="../media/copilot-communication-compliance-v2.png" alt-text="Screen capture of a Communication Compliance policy alerts page and the Copilot summary for that policy alert.":::
+    :::image type="content" source="../media/copilot-communication-compliance-v2.png" lightbox="../media/copilot-communication-compliance-v2.png" alt-text="Screen capture of a Communication Compliance policy alerts page and the Copilot summary for the policy alerts.":::
 
 1. To learn more about the message, explore other default prompts or type your own question into the text prompt in the Copilot side panel.
 
@@ -80,11 +81,11 @@ eDiscovery admins or managers spend a significant amount of time reviewing evide
 - Get a contextual summary of a single item in a review set.
 - Ask follow-up contextual questions about the summary.
 
-To use Copilot in Microsoft Purview with eDiscovery (Premium), you must be licensed for eDiscovery (Premium) and have the appropriate role permissions for Copilot and for eDiscovery. You must have access to eDiscovery (Premium) cases, and to obtain a contextual summary for an item in a review set, the Purview Review role is required. For Copilot, you need, as a minimum, the Entra Security operator or Copilot workspace contributor role.
+To use Copilot in Microsoft Purview with eDiscovery (Premium), you must be licensed for eDiscovery (Premium) and have the appropriate role permissions for Copilot and for eDiscovery. You must have access to eDiscovery (Premium) cases, and to obtain a contextual summary for an item in a review set, the Purview Review role is required. For Copilot, you need, as a minimum, the Microsoft Entra Security operator or Copilot workspace contributor role.
 
 To get started:
 
-1. Navigate to the Microsoft Purview compliance portal (this use case isn't currently supported in the new Microsoft Purview portal), then navigate to an eDiscovery. (Premium) case.
+1. Navigate to the Microsoft Purview portal (this use case isn't currently supported in the new Microsoft Purview portal), then navigate to an eDiscovery. (Premium) case.
 
 1. Navigate to and open a review set.
 
diff --git a/learn-pr/wwl-sci/security-copilot-embedded-experiences/includes/4-copilot-for-entra.md b/learn-pr/wwl-sci/security-copilot-embedded-experiences/includes/4-copilot-for-entra.md
@@ -1,14 +1,24 @@
 
-Identity risk investigation is a crucial step to defend an organization. Microsoft Entra ID Protection applies the capabilities of Microsoft Security Copilot to summarize a user's risk level, provide insights relevant to the incident at hand, and provide recommendations for rapid mitigation.
+Copilot is embedded across the Microsoft Entra admin center to help identity administrators and SOC analysts investigate and respond to identity risk. Whether you're reviewing a flagged user, assessing application risk, or correlating data across an identity-based security incident, Copilot surfaces the context you need without requiring you to navigate through multiple reports and logs manually.
 
 > [!NOTE]
 >The list of Copilot capabilities embedded in Microsoft Entra is continually growing. This unit provides just a sampling of those capabilities. For more information, see documentation on Microsoft Entra.
 
-Before you get started with Copilot in Microsoft Entra, your organization must be onboarded to Security Copilot, the Microsoft Entra plugin must be enabled in Copilot, and users must have the appropriate role permissions. Copilot assumes the permissions of the user when it tries to access the data to answer the queries, so you need to have the required permissions to access the Microsoft Entra data.
+Some of the scenarios supported through the embedded experience include:
+
+- Summarize risky user risk and get recommendations for mitigation.
+- Assess application and workload identity risk.
+- Investigate identity-based security incidents using sign-in logs, audit logs, and user details.
+
+Before you get started with Copilot in Microsoft Entra, your organization must be onboarded to Security Copilot, the Microsoft Entra plugin must be enabled in Copilot, and users must have the appropriate role permissions. Copilot assumes the permissions of the user when it tries to access data to answer queries, so you need the required permissions to access Microsoft Entra data.
+
+### Summarize risky user risk
+
+Risky user summarization is often the starting point for an identity risk investigation. Microsoft Entra ID Protection applies the capabilities of Copilot to summarize a user's risk level, provide insights relevant to the incident at hand, and provide recommendations for rapid mitigation. From a flagged user in the Risky users report, Copilot can immediately explain why the user was flagged and what to do next.
 
 To view and investigate a user’s risky sign-ins:
 
-1. Sign in to the Microsoft Entra admin.
+1. Sign in to the [Microsoft Entra admin center](https://entra.microsoft.com/).
 
 1. Navigate to Protection > Identity Protection and then to the Risky users report.
 
@@ -24,8 +34,33 @@ The risky user summary contains three sections:
 
 - Summary by Copilot: summarizes in natural language why the user risk level was elevated.
 - What to do: lists actionable insights tailored to the incident at hand to resolve the risk.
-- Help and documentation: lists customized recommendation for how to mitigate against those types of attacks, with quick links to help and documentation.
+- Help and documentation: lists customized recommendations for how to mitigate against those types of attacks, with quick links to help and documentation.
 
 Users can provide feedback on the generated content.
 
-:::image type="content" source="../media/entra-feedback.png" lightbox="../media/entra-feedback.png" alt-text="Screen capture showing the feedback menu.":::
+:::image type="content" source="../media/entra-feedback.png" lightbox="../media/entra-feedback.png" alt-text="Screen capture showing the feedback menu.":::
+
+### Investigate app risk
+
+Risky users represent one dimension of identity risk. Applications and workload identities represent another. Organizations typically have many apps registered in their tenant, and it can be difficult to identify which ones pose the greatest risk—especially when permissions are granted incrementally over time.
+
+Copilot is embedded in the **Enterprise apps**, **App Registrations**, and **Identity Protection Risky workload identities** blades of the Microsoft Entra admin center. Using natural language prompts, identity admins can ask questions like "Show me risky apps" or "Which apps have high-privilege permissions" to assess application risk across the tenant. Copilot draws on ID Protection risky workload identity data to return prioritized lists of at-risk service principals, along with their permissions, ownership, and risk level.
+
+Copilot can also surface apps with tenant-wide application permissions or highly privileged Microsoft Entra administrator roles, identify unused apps that can be quickly removed to reduce the attack surface, and flag apps with credentials approaching expiry. Direct links back to each app in the admin center let you take remediation action without leaving the investigation context.
+
+> [!NOTE]
+> Identifying risky workload identities requires a Workload Identities Premium license or a Microsoft Entra ID P2 license.
+
+### Investigate identity-based security incidents
+
+Risky user and app risk signals often surface as part of a broader security incident involving a compromised or suspicious account. When that happens, you need to correlate identity data across multiple sources—user details, sign-in logs, audit logs, and group memberships—to understand the full scope and take action quickly.
+
+Copilot in the Microsoft Entra admin center helps you do this without switching between reports. Launch the Copilot panel using the **Copilot** button in the admin center menu bar, then use natural language prompts to gather everything you need in a single investigation session:
+
+- Retrieve user profile details, including assigned roles, registered devices, and authentication methods.
+- Query risky user details—risk level, risk state, risk history, and recent risky sign-ins.
+- Review sign-in logs over a defined time period, filtered by IP address, location, or sign-in status.
+- Retrieve audit logs to identify unusual or unauthorized actions performed by the user.
+- Check group memberships to understand what resources a potentially compromised account can access.
+
+After you complete the investigation, Copilot can help you deactivate any elevated roles you activated during the session and direct you to risk remediation documentation and incident response playbooks.
diff --git a/learn-pr/wwl-sci/security-copilot-embedded-experiences/includes/5-copilot-for-intune.md b/learn-pr/wwl-sci/security-copilot-embedded-experiences/includes/5-copilot-for-intune.md
diff --git a/learn-pr/wwl-sci/security-copilot-embedded-experiences/includes/7-summary.md b/learn-pr/wwl-sci/security-copilot-embedded-experiences/includes/7-summary.md
diff --git a/learn-pr/wwl-sci/security-copilot-embedded-experiences/index.yml b/learn-pr/wwl-sci/security-copilot-embedded-experiences/index.yml

Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-Microsoft Security Copilot is accessible directly from some Microsoft security products. This solution is referred to as the embedded experience. Currently, Copilot is embedded with Microsoft Defender XDR and Microsoft Purview, with more Microsoft security solutions embedding Copilot capabilities in the near term.`
	`1`	`+Microsoft Security Copilot is accessible directly from some Microsoft security products. This solution is referred to as the embedded experience. Copilot is embedded with Microsoft Defender XDR, Microsoft Purview, Microsoft Entra, Microsoft Intune, Microsoft Defender for Cloud, and other Microsoft security solutions.`
`2`	`2`
`3`	`3`	`The Microsoft solution in which the Copilot capabilities are embedded determines the scenarios that are available through the embedded experiences. For example, in Microsoft Purview Communication Compliance, Copilot can provide a summary of a message and its attachments, in the context of the policy and classifier conditions that flagged the message.`
`4`	`4`