# Microsoft Security Copilot **Entity class:** Generative-AI security assistant **Architecture:** [[wiki/Signals, Silos, and Sovereign Software|Signals, Silos, and Sovereign Software]] ## Definition **Microsoft Security Copilot** is a generative-AI security and IT assistant for incident investigation, threat hunting, intelligence gathering, posture management, query construction, and response guidance. ## Modern Defense and Cybersecurity Role Security Copilot places a natural-language analytic surface over Microsoft's commercial security telemetry and tools. Microsoft currently states that the product is not designed for U.S. government clouds, including GCC, GCC High, DoD, and Azure Government; it should therefore be treated as a commercial-stack capability rather than an established classified-cloud service. ## Chronological Proximity It became generally available in 2024 after Microsoft had already unified Sentinel, Defender, Entra, and threat-intelligence signals into a broad security platform. ## Relational Proximity It integrates with [[wiki/Microsoft Sentinel|Sentinel]], [[wiki/Microsoft Defender XDR|Defender XDR]], [[wiki/Microsoft Entra ID|Entra]], and third-party plugins, while human analysts retain responsibility for reviewing and acting on its outputs. ## Collection Routes [[collections/The Civilian Intelligence Marketplace|The Civilian Intelligence Marketplace]] · [[collections/Terrorism, Counterterrorism, and the Intelligence Environment|Terrorism, Counterterrorism, and the Intelligence Environment]] ## Sources / Provenance - [Primary documentation](https://learn.microsoft.com/en-us/copilot/security/manage-workspaces)