Manage plugins in Microsoft Security Copilot
Important
Some information in this article relates to a prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
Security Copilot comes with many preinstalled plugins available for Microsoft security services and other commonly used services and websites that you can use. You also have the option of extending default capabilities by adding your own custom plugins.
Note
Microsoft processes and stores data from these plugins according to our Privacy and Data policies.
Watch the following video to learn more about plugins:
Manage plugins
To personalize the way Security Copilot interacts with you, there are two ways to configure the plugins on your list:
Turn plugins on or off
Copilot uses on-behalf-of authentication to access security-related data through active Microsoft plugins. If a plugin requires its own authentication setup though, the plugin determines the authentication instead of on-behalf-of. For more information, see Understand authentication.
Plugin sources are separated into these plugin categories:
- Microsoft
- Non-Microsoft
- Websites
- Custom
Select which plugins Security Copilot uses as a data source by turning service toggles on or off.
Select the Security Copilot sources icon.
Select the plugin you'd like to use by turning the toggle on or off. Custom plugins you don't have access to won't appear. Preinstalled plugins you don't have access to will indicate they are Restricted.
Personalize plugin settings
Personalize Security Copilot plugin experiences by configuring the plugin setting. For example, a user who wants the Microsoft Sentinel plugin to use a particular workspace that they designate as the default, personalizes the settings to specify the workspace.
Currently personalization settings are available for the following Microsoft plugins:
- Microsoft Sentinel
- Microsoft Defender External Attack Surface Management
Select the Security Copilot sources icon.
Select the gear icon.
Provide setting details, then select Save.
Manage custom plugins
Owners must set the permissions for adding custom plugins before they can be accessed. By default, only owners can add and manage their own custom plugins. In addition, owners are able to specify who has the ability to add and manage custom plugins for everyone in their organization.
Plugins added by owners can be set to be available only to them or to anyone in the organization.
Plugins added by owners and set to be available to anyone in the organization can be accessed, turned on or off, and used by all Security Copilot users. However, only owners can make modifications to the plugin.
For instructions on creating your own plugins, read Custom plugins.
Options for managing plugins
To manage plugins as an owner:
Select the home menu icon.
In Preferences, navigate to the Plugin settings section.
Choose who can add and manage their own custom plugins. Select Owners only or Contributors and Owners.
Owners only:
When an owner sets this configuration value, only owners can add and manage custom plugins for themselves (user scope).
Owners and Contributors:
When an owner sets this configuration value, owners and contributors can add and manage custom plugins for themselves (user scope). This option will enable the second permission, "Who can add and manage custom plugins for everyone in the organization?".
Choose who can add and manage custom plugins for everyone in the organization.
- Owners only:
When an owner sets this configuration value, only owners can add and manage custom plugins for the organization (tenant scope).
- Owners and Contributors:
When an owner sets this configuration value, owners and contributors can add and manage custom plugins for the organization (tenant scope).
Choose to manage preinstalled plugin availability and restrict access.
This is an immediate change impacting all users of Copilot for Security. Please exercise caution and notify users prior to impact. For more information, see Manage preinstalled plugins.
Add custom plugins
Adding custom plugins extends the capabilities of Security Copilot.
Important
You must take precaution and ensure that plugins you create or make available in your organization adhere to responsible AI practices. For more information, see Microsoft AI principles.
You must also ensure that custom plugins you make available to your organization are fully vetted. It is good practice to vet custom plugins at a user level first, before making plugins available to the entire organization.
Note
This option is only available if an Owner has configured Security Copilot to allow Owners and Contributors to add and manage custom plugins for everyone in the organization.
Select the Security Copilot sources icon.
In Manage plugins, scroll down to the Custom section.
Select, Add plugin.
From the drop-down options, specify if you want to make the plugin available to just yourself or anyone in the organization. Then choose between adding a Security Copilot plugin or an OpenAI plugin.
Note
If you choose to make a plugin available to just yourself, a private tag is added to the plugin. If you choose the option of making it available to anyone in the organization, then the plugin will be available to all Security Copilot users.
Depending on the plugin you'd like to add, follow the corresponding steps:
Select Security Copilot plugin.
You can choose to upload a file or upload as a link.
To upload a file:
- Select the Upload file section.
- Select the file to upload, then select Add.
To upload a link:
- Turn on Upload as a link toggle.
- Paste a link to a .yaml or .json file.
- Specify the file type.
- Select Add.
After the plugin is successfully added, some plugins might need to be set up. You can also choose to set up the plugin later.
Provide the appropriate values for the settings fields, then select Setup.
After completing the setup steps, your plugin will be visible in the Custom section. You can turn the toggle on or off.
Note
You'll need to complete the setup steps for the plugin to be available for use and appear in the Custom section.
Update custom plugin information
Depending on how owners manage custom plugins, you may be able to update your own custom plugins.
Custom plugins created by owners aren't editable by contributors.
If you need to make changes to the plugin that you added, you can edit the plugin file.
Select the Security Copilot plugin icon.
In the Custom section, select the gear icon beside the plugin that you want to update.
Select Edit file and make the appropriate updates.
Select Save and confirm that you want to proceed.
Delete added plugins
Depending on how owners manage custom plugins, you may be able to delete custom plugins you added.
Select the Security Copilot plugin icon.
In the Custom section, select the gear icon beside the plugin that you want to delete.
Select Delete and confirm that you want to proceed.