A session follows an analyst's questions. A promptbook repeats a sequence. An agent can continue a bounded task under configured permissions and triggers, such as triaging an alert, drafting a briefing, or evaluating a policy. That makes first-pass work easier to delegate. It also gives an unsupported conclusion more room to travel before a person sees it.
This lesson covers four practical decisions: which ready-made agent fits the signal, how to review its output, how to constrain a custom agent, and how guided practice relates to SC-200 or SC-500 preparation.
Choose agents by signal and evidence
Microsoft ships fifteen security agents across four workloads. Selection is a routing job. Walk the signal to the agent:
- Signal: the alert, risk, or condition that needs attention.
- Scope: the workload and records that own the relevant evidence.
- Agent: the prebuilt capability whose documented purpose matches the signal.
- Output: the supported result category, such as a classification, a briefing, a recommendation, or a risk assessment.
- Control: the human review or approval required before anything changes.
The fifteen agents cluster by the product that owns their evidence:
Start from the signal, name the workload that holds the evidence, then find the agent whose documented purpose fits, and only then think about how it launches. "Threat hunting," "security analyst," and "dynamic threat detection" all sound like threat work, but their documented purposes differ, and choosing by the closest-sounding name is how you point the wrong tool at a problem.
Availability is part of the choice
A purpose match isn't enough if the scenario isn't available in your tenant. Two agents are the most solid ground to learn on because their status is verified. The Security Alert Triage Agent classifies and triages supported alerts with a natural-language rationale. Its email and collaboration scenario is generally available and requires Defender for Office P2, while its cloud and identity scenarios are Preview with their own prerequisites. The Conditional Access Optimization Agent evaluates whether users, applications, and agent identities are covered by Conditional Access policies and produces policy-review reports. It's generally available, with activity-based runs and ServiceNow ticket creation in Preview.
Others carry Preview labels: the Threat Intelligence Briefing Agent (Public Preview since July 2025), the Security Analyst Agent (Public Preview since April 2026), and the Identity Risk Management Agent among them. A Preview label doesn't tell you an output is wrong. It tells you the scenario may change and that your readiness check has to account for it. When your own evidence doesn't establish an agent's status, the honest record is "status not established," not an assumption that it's generally available. Availability, prerequisites, and Preview state belong in the selection decision from the start.
Supervise every agent output
Review an agent's output as a claim that still needs a decision. Check that it stayed within the owning workload, performed the selected purpose, and returned a supported result such as a classification, briefing, or recommendation. It also needs to separate observed facts from unverified conclusions, leave escalation, closure, and remediation with a person, and record the correct availability and prerequisites.
Consider a phishing report with a macro-enabled attachment in an organization that has Defender for Office P2. It routes to the Security Alert Triage Agent, which should return an alert classification with rationale. An analyst compares that rationale with the email evidence and chooses the next step. Declaring the sender malicious solely because the attachment contains a macro would fail the evidence review. Claiming that remediation was complete would cross the human-control boundary. In either case, reject or revise the result before it enters the workflow.
Custom agents start from a contract
When no ready-made agent fits, define a custom agent as a testable contract. Specify its narrow task, allowed evidence, required output, prohibited claims and actions, and publishing scope. "Investigate failed sign-ins" leaves too much open. A usable contract might require the agent to summarize supplied sign-in evidence, separate input facts from tool facts, ask exactly three follow-up questions, label uncertainty, require analyst review, and never infer compromise or remediate.
Four construction paths are covered here. NL2Agent produces a draft from a natural-language description. Direct YAML gives you source that can be reviewed directly. MCP connects an approved external tool, so its data access and permissions become part of the agent boundary. Inventory what the tool exposes and reject it if that reach exceeds the task. Logic Apps places the analysis in an event-driven workflow. Begin at user scope with read-only behavior. Every response should distinguish input evidence, tool evidence, and inference. If a tool or Copilot call fails, the result must say that the analysis is incomplete.
Where do you practice and certify?
You can practice these habits without a licensed tenant. Microsoft's Experience Security Copilot through guided simulations is a fixed eleven-unit click-through covering owner settings, prompts and promptbooks, custom promptbooks, Purview and Defender XDR investigations, and agents including Conditional Access Optimization. It doesn't accept arbitrary prompts. Record only what each unit actually demonstrates.
SC-200 and SC-500 point to different kinds of work. SC-200 covers operating a security operations environment, responding to incidents, and threat hunting. Security Copilot appears within incident response. It fits analysts who investigate Defender XDR incidents and hunt in Sentinel. SC-500, the Cloud and AI Security Engineer Associate certification, is in beta as of mid-2026 and focuses more on deploying and operating security, including Security Copilot. Use the official study guide to check its current domains.
Completing a learning path shows exposure to the material. Readiness needs an artifact that you produced and checked against the current blueprint, such as an incident review that separates evidence from unknowns or a hunting-query worksheet whose tables and fields were validated. An unexecuted generated query doesn't demonstrate the skill.
