Configure Copilot settings with the owner role
Give administrators the ability to manage the data and custom plugin use in Security Copilot.
Prerequisites
You need the Security Copilot owner role to manage owner settings.
For more information, see Understand authentication in Microsoft Security Copilot.
Manage owner options
Here are the configuration options available to users with the Copilot owner role:
- Owner settings
- Plugin settings
- Role assignment - For more information, see Assign roles.
- Usage monitoring - For more information, see Monitor usage.
Owner settings
Manage the usage and data privacy for Copilot in this menu section.
- Manage capacity - Manage security compute unit association and creation.
- Help improve Copilot - Help improve Copilot by allowing Microsoft to capture data. For more information, see Data sharing and feedback options.
- Logging audit data in Microsoft Purview
- Files - For more information, see File upload.
Capacity management
Manage capacity association and geo location evaluation options. Keep in mind, purchasing new security capacity units (SCUs), changing capacity, or associating with a different capacity all require Azure Owner or Contributor access to the capacity resource in the Azure portal.
Figure shows owner setting for associating SCUs.
For more information on purchasing SCUs, see Provision capacity.
Manage logging audit data in Microsoft Purview
Manage logging audit data by configuring whether to allow Microsoft Purview to access, process, copy, and store Customer data.
Security Copilot uses Microsoft Purview to process and store data such as admin actions, user actions, and system responses.
In most scenarios, logs are available within 24 hours in Microsoft Purview after enabling the capability.
Important
Microsoft Purview will store your Customer Data in the region where your Microsoft 365 data is stored. For more information, see, Privacy and data security. The default retention period for audit logs is 180 days, but can be extended using audit log retention policies. For more information, see Manage audit log retention policies.
If you already use Microsoft Purview, no further set up is needed. Otherwise, you'll need to provision a free, limited experience. For more information, see Turn auditing on or off.
For more information, see Audit logging.
Plugin settings
Manage all plugin restrictions for your organization.
Manage custom plugins
The following custom plugin options are configurable:
- control whether contributors can add custom plugins for their sessions
- control whether contributors can publish custom plugins for everyone in the organization
For more information, see Manage plugins.
Manage preinstalled plugins
By default, all Owners and Contributors have access to preinstalled Microsoft and Non-Microsoft plugins. When an owner toggles plugin availability and restricts access, there are two options for plugin availability:
- all users
- owners only
Once access is restricted, new preinstalled plugins are made available to Owners only until configured otherwise.
Warning
This is an immediate change impacting all users of Security Copilot and embedded experiences. Please exercise caution and notify users prior to impact.
Restricted plugins affect embedded experiences. Consider the example where an analyst has access to Security Copilot and Microsoft Defender XDR, but the plugins for Microsoft Defender XDR and Natural Language to KQL are restricted. The analyst experience for Copilot in Defender looks like this:
Preinstalled plugins, like Microsoft Sentinel and Azure AI Search, require more setup. Any plugin with the gear 
or Set up button is configured per user. All users who have access to the plugin configure that plugin's setup for themselves.
Manage accessing data from Microsoft 365 services
Allow users to query information from Microsoft 365 services that your organization has licensed. For more information, see Accessing data from Microsoft 365 services.
Related content
For more information on authentication in Security Copilot, see Understand authentication in Microsoft Security Copilot.