After this day you can use Microsoft Security Copilot purposefully in investigations: you write prompts tailored to the question at hand, choose plugins and promptbooks, and know when the standalone portal or the embedded experience in Defender XDR or Purview is the better fit. You also understand what Security Copilot agents can take on and where you still need to check results yourself. The course suits analysts, administrators and SOC managers who already work with Microsoft security products and want to introduce or evaluate Security Copilot.
What you’ll take away.
- Explain the basics of generative AI, large language models and AI agents in a security context
- Phrase investigation prompts so that Security Copilot returns answers you can act on
- Pick suitable plugins and promptbooks, and export or share results with your team
- Tell the embedded Copilot experience in Defender XDR, Purview, Entra and Intune apart from the standalone portal
- Judge where Security Copilot agents can sensibly automate detection and response
Your training in detail
- Who is it for?
- Security analysts, security administrators, security engineers and SOC managers who want to introduce Microsoft Security Copilot or use it in day-to-day work.
- Prerequisites
- Practical experience of security operations and incident response, plus a working knowledge of Microsoft security products such as Defender XDR, Sentinel or Entra.
- Format & planning
- Standard length: 1 training day. A different length can be arranged for companies.
Agenda: from understanding to application
Our independently developed agenda proposal. Focus areas, lab environment and scope are agreed before booking.
Generative AI and agents: language models, prompts and typical limits
Getting to know Security Copilot: terminology, how prompts are processed, what makes a good prompt, enabling the service
Core features: plugins, promptbooks, exporting and sharing sessions
Embedded use inside Microsoft security products and the scenarios it suits
Security Copilot agents: how they take load off detection and response
Guided simulations with prompts, promptbooks, Purview and Defender XDR
In guided simulations you work through typical Security Copilot use cases: you write and refine prompts, run a promptbook and use Copilot both in the standalone portal and embedded in Microsoft Purview and Defender XDR.
Exams, licences & credentials
There is no exam or certification for this course. It introduces working with Microsoft Security Copilot and complements exam preparation such as SC-200. It is not an official Microsoft course unless the offer explicitly says so.
Vendor references & review date
Sources checked on 2026-11-10. These sources describe the technology or external exam requirements. They do not imply a partnership with NextNowa.
Your learning content
These objectives describe the training topic. The specific syllabus, dates and trainer are agreed before booking; the written offer is binding.
Frequently asked questions
Do I need my own Security Copilot environment?
No. The hands-on parts use guided simulations, so you do not need your own licence or environment.
Does the course lead to a Microsoft exam?
No. SC-5006 is an introductory course without an exam. If you are working towards a security operations certification, SC-200 is the relevant exam.
Does SC-5006 Microsoft Security Copilot: AI support for security operations include a certificate?
There is no exam or certification for this course. It introduces working with Microsoft Security Copilot and complements exam preparation such as SC-200. It is not an official Microsoft course unless the offer explicitly says so.