SC-200 Lab 2 – Microsoft Security Copilot

Microsoft Security Operations Analyst — Lab 2

Lab 2 – Microsoft Security Copilot

SC-200: Microsoft Security Operations Analyst

Overview

Explored Microsoft Security Copilot in both the standalone experience and embedded within Microsoft Defender XDR. Used Copilot to investigate a security incident and accelerate endpoint threat response using natural language prompts.

Tasks Completed

Explored the Microsoft Security Copilot standalone portal and reviewed available promptbooks and plugins
Configured Security Copilot capacity settings and connected it to the Microsoft 365 tenant
Used Security Copilot to summarize a security incident and generate a threat assessment
Switched to the Copilot embedded experience in Microsoft Defender XDR
Used embedded Copilot to investigate an endpoint alert, analyze script behavior, and generate a guided response
Reviewed Copilot session history and audit logging for prompt traceability

Environment: Microsoft 365 E5 test tenant.

Source Material

Completed using Lab 2 – Exercise 1: Explore Microsoft Security Copilot from the SC-200T00A MicrosoftLearning GitHub repository; and Exercise: Investigate and Respond with Security Copilot from Microsoft Learn. Completed in a personal Microsoft 365 E5 test tenant.

← Back to SC-200 Labs