Task 4.3: Implement Microsoft Security Copilot

• AChange the existing workspace's data storage location to the EU in Owner settings

  Incorrect

  A workspace's storage location can't be changed after creation, and the US team would move too.

• BCreate an EU workspace and let it draw on the US workspace's capacity

  Incorrect

  SCUs can't be shared between workspaces.

• CCreate a workspace with an EU storage location and link capacity of its own

  Correct

  Each new workspace picks its storage location and is powered by its own capacity.

• DTurn on prompt evaluation anywhere in the world for the existing workspace

  Incorrect

  That decides where prompts are evaluated, not where data is stored.

Customer Data is stored in the location chosen when a workspace is created, and that location can't be changed later; each new workspace can use the same or a different location. SCUs, provisioned or overage, can't be shared between workspaces, so the new workspace needs its own capacity. Prompt evaluation location is a separate setting about where GPU processing happens.

• AMicrosoft Sentinel Reader on the Sentinel workspace

  Correct

  Copilot accesses the data on behalf of the user, so the user needs the service's own role.

• BThe Copilot owner role, which extends to Sentinel data

  Incorrect

  Copilot roles control platform features, not access to security data.

• CSecurity Administrator in Microsoft Entra ID

  Incorrect

  It's a sensitive tenant-wide role, far broader than reading Sentinel incidents needs.

• DPermission for contributors to publish custom plugins for the tenant

  Incorrect

  Plugin publishing doesn't grant access to Sentinel data.

Security Copilot roles control access to the platform and give no access by themselves to security data. Copilot uses on-behalf-of authentication, so an analyst who needs Sentinel incidents still needs an Azure RBAC role such as Microsoft Sentinel Reader. Following least privilege, the analyst doesn't need a sensitive Microsoft Entra role such as Security Administrator.

• AThe preinstalled plugin restriction applies only in the standalone portal

  Incorrect

  Plugin availability settings apply to both standalone and embedded experiences.

• BContributors can edit custom plugins that owners make available to the organization

  Incorrect

  Only owners can modify those plugins.

• CSet own custom plugins to Contributors and Owners, and plugins for everyone to Owners only

  Correct

  The first setting enables the second, which owners can keep to themselves.

• DPreinstalled plugins added later are available to owners only until someone configures them

  Correct

  Once access is restricted, new preinstalled plugins go to owners only.

• ESetting up an agent that needs the restricted plugin makes the plugin available to everyone

  Incorrect

  The plugin is turned on only for that agent.

In Plugin settings, owners decide who can add custom plugins for themselves and, once contributors can, who can add them for everyone in the workspace. Restricting a preinstalled plugin is immediate and applies to both standalone and embedded experiences, and later preinstalled plugins go to owners only until configured. Plugins that owners publish can be used by all users but changed only by owners, and an agent's required plugins are enabled for that agent alone.

• ASecurity Reader

  Incorrect

  It isn't in the list of roles that inherit owner access.

• BBilling Administrator

  Correct

  Billing Administrator is one of the Entra roles that inherit owner access.

• CReports Reader

  Incorrect

  It isn't in the list of roles that inherit owner access.

• DHelpdesk Administrator

  Incorrect

  It isn't in the list of roles that inherit owner access.

Billing Administrator, Entra Compliance Administrator, Global Administrator, Intune Administrator and Security Administrator automatically inherit Security Copilot owner access, which ensures Copilot always has at least two owners.

• A3

  Incorrect

  Three is the recommended number for an introductory exploration.

• B1

  Correct

  A minimum of one provisioned SCU is required.

• C10

  Incorrect

  The minimum is lower.

• D100

  Incorrect

  That's the maximum.

Customers who aren't covered by the Microsoft 365 E5 and E7 inclusion must provision capacity, with a minimum of 1 and a maximum of 100 provisioned SCUs. Microsoft recommends 3 units with unlimited overage for an introductory exploration.

• AIn the Microsoft Entra admin center, under Roles and administrators

  Incorrect

  Copilot roles aren't Microsoft Entra roles.

• BIn the Azure portal, under Access control (IAM) for the Copilot capacity

  Incorrect

  Azure RBAC on the capacity covers SCUs.

• CIn the Microsoft Purview portal, under Roles and scopes

  Incorrect

  Purview roles can inherit owner access but aren't where Copilot roles are assigned.

• DIn Security Copilot, under Role assignment

  Correct

  Copilot roles are assigned within Security Copilot settings.

Security Copilot roles are defined and managed within Copilot. You assign them from the home menu in Security Copilot by selecting Role assignment, then Add members, and choosing Copilot owner or Copilot contributor.

• AA Copilot owner, once for the whole workspace

  Incorrect

  Setup for these plugins is per user.

• BA contributor allowed to publish plugins for everyone

  Incorrect

  Publishing rights concern custom plugins, not preinstalled plugin setup.

• CEach user who has access to the plugin, for themselves

  Correct

  Plugins with a gear or Set up button are configured per user.

• DNobody; preinstalled plugins need no setup

  Incorrect

  Some preinstalled plugins, like Microsoft Sentinel, need more setup.

Some preinstalled plugins, such as Microsoft Sentinel and Azure AI Search, require more setup. Any plugin with the gear or Set up button is configured per user, so every user who has access configures that plugin's setup for themselves.