Review access boundaries before sharing investigation results

You have asked Microsoft Security Copilot to investigate a Sentinel alert. The assistant has produced a summary that looks clear and actionable. The natural next step is to share that finding with the incident response team or a broader group of stakeholders. Before you do, you need to check the access boundaries of the data plane. A summary generated by an AI assistant is not inherently less sensitive than the raw logs it analysed. If the underlying data was restricted to a specific security group, the output should respect those same boundaries.

Microsoft Security Copilot is a generative AI-powered assistant for daily operations in security and IT that empowers teams to protect at the speed and scale of AI [1]. It connects to your existing security tools, such as Microsoft Sentinel, to provide context and analysis. However, the connection itself does not change the fundamental principle of least privilege. The Copilot service acts as a layer that reads and writes data based on the permissions of the identity used to authenticate it. If that identity has broad access, the Copilot can access and potentially expose data to anyone who can trigger or view the interaction.

Understand the data flow

When you use Security Copilot with Sentinel, the assistant retrieves data from your Sentinel workspace to answer your questions or perform investigations. This data remains within the boundaries defined by your Microsoft Entra ID and Sentinel access controls. The Copilot interface does not create a new, separate data store that bypasses these controls. Instead, it queries the existing data sources.

This means that the sensitivity of the Copilot output is directly tied to the sensitivity of the source data and the permissions of the user or service principal interacting with the Copilot. If a user has permission to view specific logs in Sentinel, they can also ask Copilot to summarise those logs. If they do not have permission, Copilot should not be able to retrieve or summarise them.

Check the identity and permissions

The first thing to verify is the identity being used to access Security Copilot. Are you using your personal account, a shared service account, or a managed identity? Each of these has different implications for access control.

If you are using a personal account, ensure that your account has the appropriate role assignments in the Sentinel workspace. The Connectors overview explains how Security Copilot connects to your data sources. The connector setup requires permissions to read from the source systems. If the connector is configured with overly broad permissions, it could allow the Copilot to access data beyond what is necessary for the investigation.

Review the role assignments in the Sentinel workspace. Common roles include Reader, Contributor, and Security Operator. A Security Operator role allows users to manage security operations but does not necessarily grant access to all data in the workspace. Ensure that the identity used for the Copilot interaction has only the permissions required for the specific investigation. Avoid using Owner or Contributor roles unless absolutely necessary, as these grant broad access to the underlying resources.

Consider the audience for the results

Once you have verified the access boundaries, consider who will see the Copilot output. If the investigation involves sensitive data, such as personally identifiable information (PII) or confidential business logic, you should limit the distribution of the results.

Security Copilot does not automatically redact sensitive information from its output. If the source data contains PII, the summary generated by the Copilot may also contain PII. You need to manually review the output and ensure that it is appropriate for the intended audience. If the output is too sensitive for a broad distribution, share it only with those who have the necessary clearance.

Verify the connector configuration

The Plugin overview describes how plugins extend the capabilities of Security Copilot. When you use a plugin to connect to Sentinel, it uses the permissions of the identity that configured the plugin. Ensure that the plugin is configured with the minimum required permissions.

If you are using a custom plugin or a community plugin, review the code and the permissions it requests. The README for the Security Copilot community repository provides guidance on contributing plugins, but it does not override the need to review the permissions of any plugin you deploy [1].

Review the output before sharing

Before sharing the Copilot investigation results, review the output for accuracy and sensitivity. The Copilot may hallucinate or include irrelevant information. More importantly, it may include sensitive data that was present in the source logs.

Compare the Copilot output with the raw logs to ensure that the summary is accurate. Check for any PII or confidential information that should be redacted. If you find any sensitive data, remove it before sharing the results. This step is crucial to prevent accidental data leakage.