Pular para o conteúdo principal

DEV-150 - Security Copilot Agents in Intune (Agentic Identity)

Implementation Effort: Medium – Requires Security Copilot setup, provisioning Microsoft Entra agentic identities, and delegating scoped Entra and Defender XDR permissions.

User Impact: Low – Assists IT and security administrators in the background; no end-user impact.

Overview​

Security Copilot Agents in Intune are specialized AI agents embedded in the Intune admin center (Agents node) that automate complex endpoint security, change review, policy creation, and lifecycle hygiene workflows:

  1. Vulnerability Remediation Agent: Analyzes Microsoft Defender Vulnerability Management exposure data, prioritizes CVE risks, and recommends or deploys Intune remediation actions (app updates or configuration changes).
  2. Change Review Agent: Evaluates Multi-Admin Approval (MAA) requests for Windows PowerShell scripts, surfacing inline risk assessments and contextual explanations of script behavior directly in the MAA approval queue.
  3. Policy Configuration Agent: Analyzes uploaded compliance documents, regulatory standards, or security benchmarks and maps them directly to recommended Intune Settings Catalog policies.
  4. Device Offboarding Agent: Identifies stale, inactive, or misaligned device records across Intune and Microsoft Entra ID and guides admins through safe, approval-gated offboarding.

Microsoft Entra Agentic Identity (2026 Update)​

Starting in 2026, Intune Security Copilot agents (such as the Vulnerability Remediation Agent and Policy Configuration Agent) run under dedicated Microsoft Entra agentic identities rather than human user accounts. Setup automatically provisions an agentic user identity in Entra ID, allowing admins to scope least-privilege Entra and Defender XDR permissions specifically to the agent and verify setup with the Run Readiness Check button.

Key Configuration Steps​

  1. Enable Microsoft Intune as a data source in Microsoft Security Copilot (Intune Administrator automatically inherits Security Copilot Owner; other Intune RBAC roles inherit Contributor).
  2. Navigate to Agents in the Intune admin center and configure the desired agents.
  3. Provision or transition each agent to a Microsoft Entra agentic identity (mandatory as human user identity support is retired).
  4. Assign least-privilege Microsoft Entra and Microsoft Defender XDR Unified RBAC permissions to the agentic identity and run the Readiness Check.

Reference​