Copilot for Security – The low down for SMB

The bottom line is that Copilot for Security is a very beneficial tool for SMB. The approach, as always with SMB, is going to be that it needs to used in a specific manner to unlock the best ROI for smaller businesses.

I want to make it clear that I have no special inside information about Copilot for Security in any way. Everything here my own experience, summation and projection of how Copilot for Security can work for SMB customers.

Copilot for Security is going to give SMB customers access to expertise, in an on demand capacity, that most would simply not be able to afford otherwise. It is also going to be able to provide this expertise when and where is required, without the need of employing additional skilled specialised staff. Thus, the best way to think of Copilot for Security is that, it is an on demand experienced and skilled cyber security specialist consultant that can be employed when required for around $4 per hour. I however would suggest that probably a better way to budget for Copilot in Security is to allocate around $100 per month for the capabilities that Copilot for Security can provide in an ongoing basis. At $100 per month for what can be done to improve your cybersecurity environment is a worthwhile investment for an SMB serious about security.

Importantly, you need to understand that Copilot for Security is not a stand alone service. It is a service from which you only get the most from if you already have appropriate security services and signals enabled in your environment. It is this data that feeds Copilot for Security and produces the quality analysis you desire. In short, a lack of signals will mean a lacks of results with Copilot for Security. So the starting point, before you invest a penny in Copilot for Security is to ensure you have everything turned on and enabled in your environment that can help Copilot for Security do its job.

You are also going to be get more from Copilot for Security the more Microsoft security services you have. I feel that Microsoft 365 Business Premium is the minimum license SMB should have if they are serious about cybersecurity. This is because Microsoft 365 Business Premium is going to give you important tools like Intune and EntraID P1 that help Copilot for Security really shine. However, I suggest you need to go beyond just Microsoft 365 Business Premium and look at additional services like Sentinel and Defender EASM to provide even greater benefit and more signals for Copilot for Security to work with.

The next step to implementing Copilot for Security is to ensure you have an Azure subscription enabled in your environment, because this is how Copilot for Security will be billed. Another important asset needed is a familiarity and comfort using the pricing tools that Azure provides, like budgets and assigning resources. These Azure skills are going to help ensure costs are monitored and you don’t end up with bill shock. Just adding an Azure subscription without knowing how to manage an Azure environment effectively will result in spending much more money that is necessary.

Copilot for Security works best out of the box with the Microsoft Security stack. Integrating with things like Defender for Endpoint (Business), Intune, Sentinel and the like are quite straight forward assuming they have been enabled prior to on boarding Copilot for Security. Also, given the on-demand approach that should be taken with SMB, it means the integrations with Microsoft Security services will largely automatically light up when the service is re-enabled as required. Yes, you can and will be able to integrate third party security services but these will typically require some reconfiguration after re-enabling the service, while the Microsoft stuff will typically just be enabled. This means less to do after re-enabling Copilot for Security when you need it.

Unfortunately, Copilot for Security in SMB will not be a set and forget proposition. Doing so will rack up enterprise size charges that are unsustainable for SMB. This means Copilot for Security in SMB will be a service that needs to be turned on and off as required. At the moment , there is no simple way to achieve this but there will be. I have already seen solutions with Azure Logic Apps Azure Functions, PowerShell, etc that automate this on demand process already. However, none yet are a simple button press. This means that, for the time being, some manual intervention is required every time that Copilot for Security is enabled or disabled. Yes, there is a cost to this manual switching approach but it is a small price to pay when compared to the cost of leaving Copilot for Security running 24/7.

Another important point to appreciate on billing is that the fact that even though you would only configure the smallest SCU of 1 initially, this scales on the demand placed on Copilot for Security. In my testing, when I have been placing load on Copilot for Security, say for investigating an incident, I have seen the SCU in use jump up as high as 4. This means you are actually paying 4 SCUs x $4 = $16 per hour with Copilot for Security. Now, if you are in the middle of major investigation I feel that sort of investment is more than justified but it is important to remember, in all aspects, Copilot for Security is a service based on consumption. That is, you pay for what you use, per hour. This is very different from the flat fee per month billing that Microsoft 365 uses.

The way that I see Copilot for Security being used effectively will be that it is enabled and set up in the tenant and then de-provisioned. Then once a week someone will come in, re-provision Copilot for Security, run some checks, ask some questions, for an hour or so and the de-provision the service. Where Copilot for Security will really shine for SMB will be by bringing security information from all the services together in one place and generating report and ‘plain english’ emails and communications for the management of a business. If you asks for a summary, Copilot for Security will generate one for you in a matter of moments which you can copy and paste and send on. Doing that alone will save hours when it comes to effectively monitoring a Microsoft 365 security environment.

The other place that I see Copilot for Security providing the business benefit in SMB will be in device management, that is, in Intune. I have been working to understand all the new settings in the updated Windows 10 Security Baseline policy and the integration with Copilot for Security has been magic. It allows me to quickly query individual settings to understand what they do rather than having to dig through granular documentation. This is a huge time saver and really helps expose the value that Intune provides because Copilot for Security can analyse, report and summarise policies as well as provide a wealth of information at your finger tips. As with most AI, the biggest benefit will come from its use with people who know the least about the service it integrates with. Intune is a great case in point here. Most IT Professionals I know have very low experience and understanding with Intune and what it can do. They are intimidated by the interface and all the settings. Copilot for Security helps overcome this and makes even a unskilled Intune operator far more effective and efficient with it. That in a nutshell is the bottom line about how SMB should look at ANY AI. It is not yet something that removes the need to do the work, it does however mean you can complete the work required without needing high levels of skill and experience with the service much faster than without it.

Another other typical place I see Copilot for Security coming into its own is during a security incident. Unfortunately, most SMBs are not prepared or experienced in dealing with a cybersecurity incident. Luckily, Copilot for Security can be called on, as needed, to provide skilled cybersecurity services. Again, Copilot for Security will not resolve or investigate the issue automatically for you, however its capabilities are going to provide the business with the skills they need to solve the issue rather than having to deploy additional human resources. Thus, when an incident is detected, Copilot for Security is provisioned to assist with the investigation. At the end of the shift, it is de-provisoned to either be used tomorrow or the next time there is an incident. Of course, the usage costs of Copilot for Security will escalate with any type of intense usage, but again having access to the capabilities of Copilot for Security in a time or need for SMB will be priceless. Most importantly, these skills can be deployed almost immediately to help resolve the issue.

We need to remember that it is still early days for Copilot for Security. That means the service will continue to improve over time. This is great for SMB because it means even while the service is de-provisioned it is improving for the next time that it is needed. Another significant different is the shift from scripts to playbooks. Without AI you largely need to use PowerShell to achieve detailed incident investigations. However, with Copilot for Security you simply ask it a number of standard questions in English to get the same result. When these standard questions are combined together you get a playbook. Thus, there will be a playbook for ransomware attack, one for business email compromise and so on. This frees the responder from having to be a PowerShell expert and have access to the right PowerShell scripts to simply running and playbook inside Copilot for Security. Many of these playbooks already exist inside Copilot for Security now and they will just keep growing. A whole community will emerge providing playbooks for Copilot for Security. Many will be incorporated directly in the product. Best of all you’ll be able to add your own based on previous situation and interactions with Copilot for Security. SMB has the most to benefit from not re-inventing the wheel and simply providing what others provide already largely for free.

There is nothing Copilot for Security does that can’t already be achieved by a skilled operator. The challenge in SMB is having access to such skilled operators and having access pretty much immediately when required. I see Copilot for Security becoming more and more integrated with the security settings we see in the Microsoft 365 security admin console. Imagine when Copilot for Security is integrated with Exchange Online threat policies and can actually adjust these automatically to make your environment more secure. I can see a day when Copilot for Security can configure a complete environment to any security framework of your choice by simply (say Essential 8) using an inbuilt playbook. The possibilities are endless and should be very exciting for those in SMB since, rarely, are their jobs to be skilled cybersecurity anaylsis and operators. Copilot for Security brings those skills down to being applied on demand, for what I would suggest is a very small investment.

In summary then, is Copilot for Security a benefit to SMB? Yes, without doubt. Does Copilot for Security need to be implemented differently in SMB? Yes, without doubt. It is all about using the tools effectively for the job and from what I see. Copilot for Security is a highly effective tool when used correctly. However, as I have talked about before, Copilot for Security has pre-requisites to make it an effective tool. The greatest of these is ensuring that signals are already in place for Copilot for Security to use. You really shouldn’t be thinking about using Copilot for Security anywhere until all that is in place purely and simply because that is what feeds Copilot for Security. Poor input leads to poor output and this Copilot for Security should not be seen as a stand alone saviour of the lack of cybersecurity skills in SMB. It should be seen as the icing on the cake of what is already a amazing stack of services from Microsoft to protect the SMB customer.

CIAOPS Need to Know Microsoft 365 Webinar – April

laptop-eyes-technology-computer_thumb

Join me for the free monthly CIAOPS Need to Know webinar. Along with all the Microsoft Cloud news we’ll be taking a look at Microsoft Teams.

Shortly after registering you should receive an automated email from Microsoft Teams confirming your registration, including all the event details as well as a calendar invite.

You can register for the regular monthly webinar here:

April Webinar Registrations

(If you are having issues with the above link copy and paste – https://bit.ly/n2k2404

The details are:

CIAOPS Need to Know Webinar – April 2024
Friday 26th of April 2024
11.00am – 12.00am Sydney Time

All sessions are recorded and posted to the CIAOPS Academy.

The CIAOPS Need to Know Webinars are free to attend but if you want to receive the recording of the session you need to sign up as a CIAOPS patron which you can do here:

http://www.ciaopspatron.com

or purchase them individually at:

http://www.ciaopsacademy.com/

Also feel free at any stage to email me directly via director@ciaops.com with your webinar topic suggestions.

I’d also appreciate you sharing information about this webinar with anyone you feel may benefit from the session and I look forward to seeing you there.

CIAOPS Brief 20240406

Editors note *** Thought I’d try something different this week and feed all the links into Copilot for Microsoft 365 and ask for a summary. Let me know if you prefer this or the older way with just the links?

Empowering Security Policy Creation with Copilot in Microsoft Intune –

https://www.youtube.com/watch?v=X3CXUeyHdHw

China tests US voter fault lines and ramps AI content to boost its geopolitical interests –

The blog post you referred to discusses how **China** is using **fake social media accounts** to poll voters on divisive issues to potentially influence the outcome of the U.S. presidential election. It also mentions the increased use of **AI-generated content** by China to further its global influence goals. Specifically, the Taiwanese presidential election in January 2024 saw a significant use of AI-generated content by CCP-affiliated actors, marking the first instance where Microsoft Threat Intelligence observed a nation-state actor using AI content to influence a foreign election [1](https://blogs.microsoft.com/on-the-issues/2024/04/04/china-ai-influence-elections-mtac-cybersecurity/).

Unlock Your Cybersecurity Potential: Explore the Security-101 Curriculum! –

https://techcommunity.microsoft.com/t5/educator-developer-blog/unlock-your-cybersecurity-potential-explore-the-security-101/ba-p/4071368

Get end-to-end protection with Microsoft’s unified security operations platform, now in public preview –

The article you’re referring to is about Microsoft’s unified security operations platform, which is now in public preview. It highlights the embedded Copilot experience within the Microsoft Defender portal for security information and event management (SIEM) and extended detection and response (XDR). This platform is designed to assist users as they investigate and respond to threats by automatically surfacing relevant details. [1](https://www.microsoft.com/en-us/security/blog/2024/03/13/microsoft-copilot-for-security-is-generally-available-on-april-1-2024-with-new-capabilities/) Unfortunately, I couldn’t find more detailed information within your company’s resources, but this should give you a good overview of the article’s content.

https://www.microsoft.com/en-us/security/blog/2024/04/03/get-end-to-end-protection-with-microsofts-unified-security-operations-platform-now-in-public-preview/

Get started with phishing resistant multifactor authentication –

https://www.youtube.com/watch?v=fSIM_Zrlv70

Bringing the latest capabilities to Copilot for Microsoft 365 customers –

The latest blog post on the Microsoft 365 website announces two significant updates for Copilot for Microsoft 365 users. Firstly, priority access to the GPT-4 Turbo model is being introduced to work with both web and work data. Additionally, the limitations on the number and length of conversations are being removed, and file upload capacity is increasing. Secondly, later this month, there will be an expansion of capabilities, although the details of this expansion are not provided in the snippet. For more information, you can visit the Microsoft 365 blog. [1](https://www.microsoft.com/en-us/microsoft-365/blog/2024/04/02/bringing-the-latest-capabilities-to-copilot-for-microsoft-365-customers/)

https://www.microsoft.com/en-us/microsoft-365/blog/2024/04/02/bringing-the-latest-capabilities-to-copilot-for-microsoft-365-customers/

Further simplifying the Microsoft Defender for Endpoint onboarding experience with Microsoft Intune –

The TechCommunity post titled “Further simplifying the Microsoft Defender for Endpoint onboarding experience with Microsoft Intune” by Laura Arrizza, a Senior Product Manager at Microsoft Intune, discusses the enhancements made to simplify the deployment and configuration of Microsoft Defender for Endpoint. The improvements focus on making the onboarding process more straightforward for admins, with a streamlined experience for discoverability, deployment, and continuous monitoring across devices. This initiative is part of Microsoft’s commitment to providing increased visibility and transparency into the state and status of devices managed through Microsoft Intune. [1](https://techcommunity.microsoft.com/t5/intune-customer-success/further-simplifying-the-microsoft-defender-for-endpoint/ba-p/4097995)

https://techcommunity.microsoft.com/t5/intune-customer-success/further-simplifying-the-microsoft-defender-for-endpoint/ba-p/4097995

Comprehensive macOS management with Microsoft Intune –

https://www.youtube.com/watch?v=2BOBqJdxRnM

Microsoft Defender for Cloud Free Trial per Plan –

The TechCommunity post you’re referring to provides a comprehensive guide on the free trial offerings for Microsoft Defender for Cloud. It details the different plans available and the benefits of each, emphasizing the value of trying the service to understand its capabilities in protecting cloud environments. The post likely outlines the duration of the free trial, what features are included, and how users can sign up to experience the service firsthand.

https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/microsoft-defender-for-cloud-free-trial-per-plan/ba-p/4102865

Improved task list components in Loop –

The blog post on Microsoft 365 Insider discusses the improved task list components in Microsoft Loop, highlighting the integration with Outlook and the ability to embed task management via Loop components. It mentions that tasks assigned in Loop are automatically synchronized with Microsoft To-Do and Planner, allowing for efficient tracking of tasks in one place. The post also details how Microsoft Loop components are currently available in Teams and Outlook, with general availability to be announced for other applications like Word. [1](https://ciaops365e1-my.sharepoint.com/personal/admin_ciaops365_com/Documents/Supplier/Microsoft/CSP%20Masters%20-%20Sales/CSP%20Masters%20-%20S3%20-%20ModerWorkplace.pdf?web=1)

Additionally, web sources indicate that the updated task list components in Microsoft Loop offer greater flexibility and functionality, with a new look and feel that aligns with Loop pages for consistency. Users now have increased control through filters to narrow down tasks by various criteria and can adjust row height to fit content. [2](https://www.hubsite365.com/en-ww/crm-pages/improved-task-list-components-in-loop-ee3f541c-c3d7-45c2-a7da-cd6b32cdf888.htm)

https://insider.microsoft365.com/en-us/blog/improved-task-list-components-in-loop

Microsoft Priva announces new solutions to help modernize your privacy program –

The Microsoft Security blog post from April 2, 2024, announces the expansion of **Microsoft Priva**, introducing automated capabilities to help organizations adapt to evolving privacy requirements concerning personal data. Microsoft Priva aims to protect personal data, automate risk mitigation, and manage subject rights requests at scale. It’s designed to assist organizations in meeting privacy and compliance requirements, mitigating risks for privacy non-compliance, and preparing for new and emerging regulations with an end-to-end solution that oversees and establishes privacy protocols across the entire organization. [1](https://www.microsoft.com/en-us/security/blog/2024/04/02/microsoft-priva-announces-new-solutions-to-help-modernize-your-privacy-program/)

https://www.microsoft.com/en-us/security/blog/2024/04/02/microsoft-priva-announces-new-solutions-to-help-modernize-your-privacy-program/

Microsoft FAQ and guidance for XZ Utils backdoor –

The article “Microsoft FAQ and guidance for XZ Utils backdoor” addresses a critical vulnerability identified in XZ Utils, specifically versions 5.6.0 and 5.6.1. This vulnerability, labeled CVE-2024-3094, has a CVSS score of 10 and is the result of a software supply chain compromise. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has recommended downgrading to a previous, non-compromised version of XZ Utils. The article provides details and Microsoft’s response to this vulnerability. [1](https://techcommunity.microsoft.com/t5/microsoft-defender-vulnerability/microsoft-faq-and-guidance-for-xz-utils-backdoor/ba-p/4101961)

https://techcommunity.microsoft.com/t5/microsoft-defender-vulnerability/microsoft-faq-and-guidance-for-xz-utils-backdoor/ba-p/4101961

A Copilot for Security Customer’s Guide to MDTI –

The blog post titled “A Copilot for Security: Customer’s Guide to MDTI” discusses the strategic use of Microsoft Defender Threat Intelligence (MDTI) to enhance various security workflows. MDTI is a comprehensive threat intelligence product that supports triage, incident response, threat hunting, vulnerability management, and cyber threat intelligence analyst workflows. The post emphasizes the importance of MDTI in powering Security Copilot, which is designed to assist analysts with complex and time-consuming daily tasks. [1](https://techcommunity.microsoft.com/t5/microsoft-defender-threat/new-blog-how-mdti-helps-power-security-copilot/td-p/3984271)

https://techcommunity.microsoft.com/t5/microsoft-defender-threat/a-copilot-for-security-customer-s-guide-to-mdti/ba-p/4103238

Discover the power of Microsoft Certifications for your career –

The article titled “Discover the power of Microsoft Certifications for your career” invites readers to join the Microsoft Learn Learning Room, hosted by Tiago Costa—Your Azure Expert. It’s a space designed for expanding knowledge, engaging in discussions, and preparing for Microsoft Certification. The article highlights the value of certifications like the Microsoft Certified: Azure Administrator Associate, which requires passing a comprehensive exam (Exam AZ-104) that covers managing Azure identities and governance, implementing and managing storage, deploying and managing Azure compute resources, among other skills. The article emphasizes the career benefits of earning Microsoft Certifications and the rigorous process involved in obtaining them. [1](https://techcommunity.microsoft.com/t5/microsoft-learn-blog/discover-the-power-of-microsoft-certifications-for-your-career/ba-p/4090763)

https://techcommunity.microsoft.com/t5/microsoft-learn-blog/discover-the-power-of-microsoft-certifications-for-your-career/ba-p/4090763

Native-first cloud security approach –

The article titled “Native-first cloud security approach” on the Microsoft Tech Community discusses the importance of integrating security measures natively into cloud platforms. It highlights the challenges of integrating best-of-breed solutions, which may not seamlessly integrate with each other or with the specific cloud platform being used, leading to gaps in visibility and coordination. The article emphasizes the need for a unified view of the security landscape to effectively protect against threats. [1](https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/native-first-cloud-security-approach/ba-p/4102367) For more detailed insights, you may want to read the full article on the Tech Community website.

https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/native-first-cloud-security-approach/ba-p/4102367

Realigning global licensing for Microsoft 365 –

The page you referred to announces a realignment in the global licensing for Microsoft 365 and Office 365 suites, specifically mentioning that Teams will not be included in the new lineup of commercial suites for regions outside the EEA and Switzerland. Additionally, there is a new standalone Teams offering for Enterprise customers in those regions. This change aims to provide globally consistent licensing to streamline decision-making and negotiations for customers. The announcement was made on April 1, 2024. [1](https://www.microsoft.com/en-us/licensing/news/Microsoft365-Teams-WW)

https://www.microsoft.com/en-us/licensing/news/Microsoft365-Teams-WW

The Microsoft Power Platform community is buzzing about Microsoft Copilot, governance, and scale –

The blog post on the Microsoft Power Platform community’s excitement about Microsoft Copilot discusses the positive reception and insights shared by users, makers, developers, and business leaders at the Microsoft Power Platform Conference. They expressed how Copilot empowers them to elevate their work and business operations. The post is likely to highlight the governance and scale aspects of Microsoft Copilot within the Power Platform ecosystem. [1](https://www.microsoft.com/en-us/power-platform/blog/2024/03/28/the-microsoft-power-platform-community-is-buzzing-about-microsoft-copilot-governance-and-scale/)

For a detailed summary and insights, you can visit the blog post on the Microsoft Power Platform website. [1](https://www.microsoft.com/en-us/power-platform/blog/2024/03/28/the-microsoft-power-platform-community-is-buzzing-about-microsoft-copilot-governance-and-scale/)

Microsoft Mesh: A new way to connect –

The blog post titled “Microsoft Mesh: A New Way to Connect” introduces Microsoft Mesh as a platform that integrates with Microsoft Teams to create immersive virtual spaces for collaboration. It allows people in different physical locations to participate in shared experiences using various devices, enhancing the sense of co-presence and reducing the need for travel. The post likely covers how Mesh can be used in Teams meetings, its benefits for the modern workplace, and the potential impact on communication and collaboration. For a comprehensive understanding, it would be best to read the full article. [1](https://www.microsoft.com/en-us/microsoft-365/blog/)[2](https://en.wikipedia.org/wiki/Microsoft_Mesh)[3](https://learn.microsoft.com/en-us/mesh/)[4](https://techcommunity.microsoft.com/t5/microsoft-teams-blog/microsoft-mesh-transforming-how-people-come-together-in-the/ba-p/3824898)[5](https://www.microsoft.com/en-us/microsoft-teams/microsoft-mesh)[6](https://apps.microsoft.com/detail/9nlxzj1fdbd7?hl=en-us&gl=US)

https://insider.microsoft365.com/en-us/blog/microsoft-mesh-a-new-way-to-connect

SharePoint Roadmap Pitstop: March 2024 –

The “SharePoint Roadmap Pitstop: March 2024” blog post on the Microsoft Tech Community highlights the latest updates and offerings for SharePoint. The key features introduced in March 2024 include new section backgrounds, Answers in Viva content in Microsoft Search, and the ability to enable/disable certain features in SharePoint Premium. The post emphasizes the continuous improvement and expansion of SharePoint capabilities, ensuring users have access to the most up-to-date and efficient tools for their tasks. [1](https://techcommunity.microsoft.com/t5/microsoft-sharepoint-blog/sharepoint-roadmap-pitstop-march-2024/ba-p/4101910)

For a detailed overview of the new features and updates, you can read the full blog post on the Microsoft Tech Community website. [1](https://techcommunity.microsoft.com/t5/microsoft-sharepoint-blog/sharepoint-roadmap-pitstop-march-2024/ba-p/4101910)

Hunting and responding to QR code-based phishing attacks with Defender for Office 365 –

The blog post titled “Hunting and Responding to QR Code-Based Phishing Attacks with Microsoft Defender for Office” discusses the increasing trend of QR code-themed phishing campaigns. The Microsoft Defender Experts team has observed attackers using deceptive QR codes to manipulate users into accessing fraudulent websites or downloading harmful content. The post emphasizes the importance of being vigilant against such phishing attempts and provides insights into how Microsoft Defender for Office can help in identifying and responding to these threats. For a detailed exploration of the topic, I recommend reading the full blog post. [1](https://techcommunity.microsoft.com/t5/microsoft-security-experts-blog/hunting-for-qr-code-aitm-phishing-and-user-compromise/ba-p/4053324)

Public Preview: High Volume Email for Microsoft 365 –

The blog post titled “Public Preview: High Volume Email for Microsoft 365” on the Microsoft Tech Community announces the public preview of High Volume Email (HVE) for Microsoft 365. This service is designed for line-of-business applications and other high-volume SMTP Auth submissions, allowing for sending internal messages beyond the current limits of Exchange Online. The public preview includes an admin experience in the Exchange admin center to manage HVE accounts, a report to track usage, and a specific SMTP endpoint using basic SMTP auth to send email. [1](https://techcommunity.microsoft.com/t5/exchange-team-blog/public-preview-high-volume-email-for-microsoft-365/ba-p/4102271)

Microsoft Copilot for Security is now generally available –

The blog post on the Microsoft Tech Community titled “Microsoft Copilot for Security is now generally available” announces the general availability of Microsoft Copilot for Security starting April 1, 2024. This generative AI solution is designed to help security and IT professionals by providing new capabilities and tools across the security portfolio to protect and govern AI use. It is available for purchase as a consumption offering with a simple pricing model that covers both the standalone Copilot experience and embedded experiences across the Microsoft Security product portfolio. [1](https://www.microsoft.com/en-us/security/blog/products/microsoft-copilot-for-security/)[2](https://techcommunity.microsoft.com/t5/microsoft-security-copilot-blog/microsoft-copilot-for-security-general-availability-details/ba-p/4079970)[3](https://www.microsoft.com/en-us/security/blog/2024/03/13/microsoft-copilot-for-security-is-generally-available-on-april-1-2024-with-new-capabilities/)

For a detailed understanding, I recommend reading the full blog post. [1](https://www.microsoft.com/en-us/security/blog/products/microsoft-copilot-for-security/)

Building a foundation for AI success: Governance –

The article titled “Building a foundation for AI success: Governance” is the last post in a six-part blog series on The Microsoft Cloud Blog. It discusses the importance of governance in AI success and is part of a broader conversation about AI readiness that includes business strategy, technology and data strategy, AI strategy and experience, among other topics. Unfortunately, I cannot provide a direct summary of the article, but I encourage you to read it for a comprehensive understanding of the governance aspect in AI development and implementation. [1](https://www.microsoft.com/en-us/microsoft-cloud/blog/2024/03/28/building-a-foundation-for-ai-success-governance/)

What’s new in Microsoft Intune March 2024 –

https://techcommunity.microsoft.com/t5/microsoft-intune-blog/what-s-new-in-microsoft-intune-march-2024/ba-p/4098989

After hours

We think we’re good at multitasking – https://www.youtube.com/shorts/iDjkILCPZ8I

Editorial

If you found this valuable, the I’d appreciate a ‘like’ or perhaps a donation at https://ko-fi.com/ciaops. This helps me know that people enjoy what I have created and provides resources to allow me to create more content. If you have any feedback or suggestions around this, I’m all ears. You can also find me via email director@ciaops.com and on X (Twitter) at https://www.twitter.com/directorcia.

If you want to be part of a dedicated Microsoft Cloud community with information and interactions daily, then consider becoming a CIAOPS Patron – www.ciaopspatron.com.

Watch out for the next CIA Brief next week.

New Endpoint Security Windows Baseline

Microsoft have released an updated Endpoint Security Baseline for Windows 10 and later.

I have updated my Best Practices repository to include the new template JSON file here:

https://github.com/directorcia/bp/blob/main/Intune/Policies/Endpoint/Baselines/win.json

and the older JSON file here:

https://github.com/directorcia/bp/blob/main/Intune/Policies/Endpoint/Baselines/Archive/win.json

I have also found that the Graph endpoint to which these two policies are applied is also different.

The new Security Baseline for Windows 10 now has an enormous area under Administrative templates. It also has a LAPs setting.

You can’t upgrade the older policy to the newer one, you need to create a completely new Security Baseline using the new policy.

This is going to take some time to work through all the new options that have been added, and there are many!

Luckily, I can put Copilot for Security to work to help me!

Copilot for Security–The day after

Having set up Copilot for Security yesterday,

A day with Copilot for Security

and having an initial look around I decided to de-provision it after I was done for the day.

I returned the following day and set it all back up again using the same process as before. No issues.

I had a quick look at the billing in my Azure portal and noticed that some charges had appeared as shown above. They seem to however lag actual usage by at least 24 hours or more, so keep that in mind if you are trying to track costs closely

Because I also have Intune in the environment I took a look at where Copilot for Security is surfaced there. As you can see you get a big message in the homepage of the Intune portal when you navigate there reminding you that Copilot for Intune is available to you as part of Copilot for Security.

If you visit the Intune Tenant Admin area you’ll find a Copilot area as shown above. My check icon was green so I knew everything was working as expected.

I then opened a policy and found a Summarize with Copilot button which I used to generate the summary you see on the right hand side of the policy. Very handy.

I also found a Copilot button when I looked at individual devices. As you can see above, I can use Copilot to give me a comparison between the apps installed on devices. Nice.

I then generated some security ‘incidents’ on a device and checked the device in the Microsoft Security portal to see how Copilot would be surfaced. You’ll see it appears as a pane on the right, as shown above.

You’ll see in the above screen shot, I got Copilot to draft and email to send to the user of the problem machine. Very handy.

After playing around some more I went and looked at the Copilot for Security usage and you can see above, my unit usage was significantly higher than I initially provisioned. I assume I will be billed for those 3.7 units at US$4ph x the time I was actually playing around (about 1 hour). Let’s see when the costing make their way into the Azure portal.

I then went off and asked Copilot for Security about how to make my environment Essential 8 compliant, and you can see the response above.

I also found where you can upload you own company files to the environment to give it even more information you can use in your investigations.

I found an area where there was an option to allow Copilot for Security to access my Microsoft 365 data, shown above.

However, for whatever reason, it did not allow me enable this option as you can see from the error above. I’ll try that again during my next session.

So today’s session has shown me that you can de-commission and re-commission Copilot for Security on demand. At the moment that is a manual process via the GUI, but I expect that I’ll be able to script that with something PowerShell soon enough.

Without Copilot for Security being re-enabled I found that most Copilot menu items in places like Intune remained but failed to operate, not unexpectantly. However, when I re-provisioned Copilot for Security again on the second day, all those options worked again. Some took and little while to ‘refresh’, but they all started working again as on the first day.

I also noticed that all my previous chat sessions where all still available and accessible. This is thanks to retention that is part of Copilot for Security. I just need to find out how long that retention is.

So the main thing I learnt from day 2 with Copilot for Security is that you can utilise it on demand. It doesn’t seem that you actually need to have it running 24/7, which is great new for smaller businesses on a budget. I’m sure you get more out of it if you do indeed leave an SCU running 24/7 but seems to me, so far, that you don’t lose much just enabling it as you need.

I also learned that the cost reporting seems to take at least 24 hours to start appearing which can make budgeting a little butt clenching until the actual cost figure appear in the Azure portal. I also learned that after you enable Copilot for Security the menu option remain in the various portals, even after your de-provision the service. Now, these may indeed disappear after a period time if you don’t re-provision but I’d find any of the disable menu items presented any errors, they just didn’t do anything any more. Which is understandable.

In short, I think Copilot for Security will work in an SMB environment but currently, you’ll need to a bit of manual labour to enable and disable the service but I expect that can be improved with automation down the track.

I’ll be playing with Copilot for Security for another day and I’ll then share my overall thoughts and feedback on what I’ve seen and the ROI it provides. However, I will certainly be implementing this, in an on demand capacity, in my production environment.

More updates soon from day 3.

A day with Copilot for Security

Given that Copilot for Security has just been released, I thought I’d spin it up in my tenant and see what it looks like.

To get the most from Copilot for Security you’ll first need to have an Azure subscription. You’ll get more out of the service if you also have Intune and Sentinel as well as aggregation of your logs, but an Azure subscription is all you need to get started.

The easiest way to commence the set up process is to visit:

https://securitycopilot.microsoft.com

where you’ll be greeted with the set up wizard shown above.

Prior to setting up Copilot for Security, as I mentioned, you need an Azure subscription and I’d also recommend setting up a dedicated Azure Resource Group to help monitor and manage costs.

It is important to under what this will cost you in the default configuration. That is detailed on this page:

Yup, you read right $2,880 per month is the minimum! That is basically $4 per hour over 730 hours in a month. So, ensure you turn all this OFF once you have finished testing!

Once you complete all the listed fields you can continue.

You’ll need to wait a moment or two as the service is set up.

Since the Azure Resource Group into which I’m placing Copilot for Security is in Australia, my data will also be in Australia.

You’ll then be asked whether you wish to help Copilot improve as shown above. Make your choice and continue.

Next, you get the option to set up any permissions. As this is simply a test and I’ll be the only one using it I didn’t make any changes and just continued.

You should be all good to go as shown above.

If you now return to the initial starting point:

https://securitycopilot.microsoft.com

you should see the above, where you can input your query.

If you look in the Azure back end you will see a new item called Copilot inside your Azure portal, which looks like the above.

Selective the resource displayed the above.

You’ll also notice that you can’t adjust the Security Compute Units (SCU) below 1.

By clicking this button in the prompt

you’ll see all the plugins that can be configured in your environment

So, I went off and had a play to see what results it would give me.

I asked for some summaries.

and I had a look at some inbuilt playbooks.

I them dug around into the Usage monitoring which you’ll find the menu at the top left of the page.

In here I could change the Security compute units and delete them as well. Which I did eventually after play around a bit more.

Clearly, most smaller businesses are not going to justify running this full time. It is therefore VERY important to delete the SCU when you have finished playing around. After doing that and running Copilot for Security I was interested to see my bill, but as yet no amounts have appeared in my Azure portal. I’ll share these when they appear.

I still however believe this can be an effective security tool for SMB, PROVIDED, you enable and disable it as required, kind of on demand. I’m playing with doing that for myself to better understand any limitations on that approach and I’ll report back.

I have more to share on my findings so far so stay tuned.