Microsoft Security Copilot and How it Relates to Data Protection

Recently, I provided an overview of Security Copilot.  In that post, I discussed the 50,000-foot view of Security for Copilot, its origins, and some of its use cases.  Security for Copilot encompasses a pretty large area of focus in the Microsoft environment.  And to be honest, it isn’t limited to just Microsoft products.  Already, there are dozens of integrations with other tools, such as CrowdSec, Darktrace, CheckPhish, and more.  Check out the Integrations section of the Microsoft Security Copilot page to see all the integrations you can have. But if you are familiar with the area I work in, I am more focused on data protection and compliance.  And thankfully, there are integrations that Security Copilot can help with.  So, in this post, I’ll cover Copilot for Security and how it relates to data protection.  My future posts will begin to provide use cases and examples that you can build on yourself within your own organization.

As always, please be aware of my blog disclaimer

Security Copilot and How it Relates to Data Protection

If you clicked on the link above, you will have noticed that Security Copilot integrates into many Azure and M365  features such as Entra and Defender.  Thankfully, it also integrates with Microsoft Purview as well.  Within Purview, Security Copilot integrates with Data Loss Prevention (DLP), Insider Risk Management (IRM), Communication Compliance, and eDiscovery.  Unfortunately, it doesn’t really integrate with Microsoft Purview Information Protection (MPIP) or Records Management, except where the capabilities overlap within the four that are supported.

So what does this mean for those who are focusing on maintaining the integrity of the data and ensuring it isn’t being misused, overshared, at risk, etc?  The tools that Security Copilot integrates are the tools that monitor and protect the sharing of content within an organization.  So this means that you can use Security Copilot to help you understand if your data is at risk if your users are performing risky activities and other similar reviews.

Why are Other Features of Purview Not Supported?

Because I work a lot with record management, I am often asked by record managers: “How can Copilot help me with managing the records in my environment?”.  Unfortunately, the answer is that it can’t.  This is quickly followed up with: “Why not?”.  Allow me to display a couple of screenshots before I answer that question for you:

Let’s take a look at the Data Loss Prevention, Insider Risk Management, and Records Management consoles in Purview:

DLP:                        IRM:                             RM:

Did you see it?  Look again:

DLP:                    IRM:                           RM:

The short answer is that Copilot works with the audit logs in Purview.  DLP, IRM, and Communication Compliance all generate alerts via the audit log.  Records Management, Data Lifecycle Management, etc do not.  Because of this, Copilot will not directly interface with those features.  Will this always be the case?  I hope not, and I expect not.  But right now, Security Copilot is in its infancy.  Who knows where it will go?

Security Copilot Still Has Awareness of Where You Are in Purview

Even though Security Copilot can’t directly assist you with the features of Records Management or DLM, it is still able to assist you when you are in those areas of Purview.

Notice that the context of Purview switched automatically for me to provide suggested questions for Records Management.  BTW, the first question, “How do I fix retention labels in Record Management?” took a total of 0.312 SCUs.

Data Protection and Security Copilot

Getting the information on the data I am looking for is pretty straight forward for the most part.  There are two methods to access data protection information via Security Copilot

The first is directly from Security Copilot at https://securitycopilot.microsoft.com/  Just create a new session and tell Copilot what you are looking for.  Remember that your query wording matters.  You’ll notice in my screenshot below, that Copilot was smart enough to know it needed to use Purview based on my request (which I expected it to be able to do).

I am able to get additional information by going to DLP Console itself.  Because Security Copilot is now embedded into Purview I can actually have Copilot provide suggestions or reviews of my environment for me.  This is done via the “Get insights with Copilot” button in the Policy tab.

In my next Security Copilot posts, I’ll create some alerts in Purview and have Copilot assist me in managing them.

Thanks for reading!