Security Copilot Promptbooks

Reusable, read-only Microsoft Security Copilot promptbooks for evidence-driven Microsoft Entra monitoring, triage, and validation.

These promptbooks are designed as two complementary workflows:

Application Change Monitor
        |
        v
Application Risk Validator

Privileged Access Change Monitor
        |
        v
Privileged Identity Validator

The monitors identify new or noteworthy objects and provide deterministic identifiers. The validators investigate a selected application or privileged identity in greater depth. All four workflows are read-only and require analyst review before remediation or containment.

Repository contents

Security-Copilot-Promptbooks/
|-- Entra-Application-Change-Monitor-v1.3.txt
|-- Entra-Application-Risk-Validator-v4.0.txt
|-- Entra-Privileged-Access-Change-Monitor-v1.2.txt
|-- Entra-Privileged-Identity-Validator-v4.1.txt
`-- README.md

Promptbook and PowerShell validation map

The PowerShell companions are maintained separately in rolling-code/PowerShell-Scripts. They provide deterministic evidence that can validate or expand Security Copilot findings. They do not necessarily reproduce every Security Copilot data source.

Entra-Application-Change-Monitor-v1.3.txt
  -> list_all_applications2.ps1
  -> Profile-App.ps1
  -> BulkMultiPermExploitability2.ps1
  -> Audit-AppDelegationRisks.ps1

Entra-Application-Risk-Validator-v4.0.txt
  -> Profile-App.ps1
  -> Audit-AppDelegationRisks.ps1
  -> BulkMultiPermExploitability2.ps1

Entra-Privileged-Access-Change-Monitor-v1.2.txt
  -> Audit-AllUsersRolePerms.ps1
  -> enum_entra_admins.ps1

Entra-Privileged-Identity-Validator-v4.1.txt
  -> Audit-AllUsersRolePerms.ps1
  -> get_policies.ps1
  -> find_disabled_accounts.ps1

Promptbooks

Entra Application Change Monitor v1.3

Performs a time-bounded discovery review of Microsoft Entra application registrations and service principals. It retrieves newly created objects, completes available pagination, pairs application registrations and service principals by exact Application ID, reconciles object and logical-identity counts, and selects unique candidates for deeper validation.

What it does:

• Reviews application registrations and service principals created during <LookbackDays>.
• Pairs related objects using the Application ID, never the display name.
• Distinguishes directory-object counts from logical application identities.
• Avoids treating new, unmatched, unverified, unusually named, single-tenant, managed, or workload identities as vulnerabilities by themselves.
• Produces candidate blocks containing Application ID and object IDs for the downstream risk validator.
• Does not inspect credentials, permissions, consent, owners, redirect URIs, roles, business purpose, or sign-in activity.

How to use it:

1. Create or edit a Security Copilot promptbook.
2. Paste the complete prompt from Entra-Application-Change-Monitor-v1.3.txt.
3. Verify that LookbackDays appears under Inputs you'll need.
4. Run the promptbook with a positive whole-number lookback period.
5. Copy candidate Application IDs and service-principal Object IDs into Entra Application Risk Validator.

PowerShell validation:

• list_all_applications2.ps1 creates a deterministic inventory of application registrations and enterprise application service principals.
• Profile-App.ps1 creates a detailed governance profile for one Application ID.
• BulkMultiPermExploitability2.ps1 reviews granted high-impact application and delegated permissions across an inventory.
• Audit-AppDelegationRisks.ps1 performs a focused delegated-consent review for a selected application.

Entra Application Risk Validator v4.0

Performs a detailed, manually initiated validation of one Microsoft Entra application identity. It uses the Application ID as the primary resolution key and can optionally validate an exact tenant-local service-principal Object ID.

Inputs:

• Required: <ApplicationId>
• Optional: <ServicePrincipalObjectId>; use Unknown when unavailable
• Required: <LookbackDays>

What it reviews when supported:

• Application registration and service-principal resolution
• Ownership and business-purpose evidence
• Secret, certificate, and federated credential metadata
• Delegated and application permissions
• OAuth consent grants and app-role assignments
• Microsoft Entra and Azure role assignments
• Redirect URIs and application configuration
• Audit events and service-principal activity
• Evidence completeness, DevOps-story criteria, and immediate-investigation criteria

How to use it:

1. Supply the Application ID from the Change Monitor or another authoritative inventory.
2. Supply the exact service-principal Object ID when available, otherwise enter Unknown.
3. Select a positive whole-number lookback period.
4. Review collection status before accepting the final decision.
5. Validate important findings with the linked PowerShell scripts before remediation.

PowerShell validation:

• Profile-App.ps1 is the primary deterministic companion.
• Audit-AppDelegationRisks.ps1 validates delegated grants, tenant-wide consent, privileged scopes, and assignments.
• BulkMultiPermExploitability2.ps1 compares application permissions against a configurable high-risk catalog.

Entra Privileged Access Change Monitor v1.2

Creates an exportable inventory of Microsoft Entra privileged-role assignments and provides the tenant-local Identity Object IDs required by the downstream Privileged Identity Validator.

What it does:

• Retrieves user, guest, group, service-principal, managed-identity, direct, group-based, and PIM assignments when supported.
• Preserves Identity Object IDs, Role Definition IDs, assignment states, and assignment sources.
• Requires inventory-row and unique-identity reconciliation.
• Marks collection Partial when pagination, output limits, missing Object IDs, or count reconciliation prevent a complete baseline.
• Does not approve a new baseline from a Partial inventory.
• Produces a Validator Handoff with Object ID and suggested lookback period.

How to use it:

1. Run the promptbook without modification in a Security Copilot session that has the required Entra access.
2. Export the inventory when needed.
3. Treat returned rows as evidence, and verify that narrative counts reconcile with the export.
4. Copy an Identity Object ID from Validator Handoff into Entra Privileged Identity Validator.
5. Do not treat Not Detected as Confirmed Absent when collection is Partial.

PowerShell validation:

• Audit-AllUsersRolePerms.ps1 provides tenant-wide deterministic evidence for directory roles, Azure RBAC, role-assignable groups, and effective privilege paths.
• enum_entra_admins.ps1 is a secondary discovery helper for administrator-like groups and nested membership. Name matching is a lead, not proof of privilege.

Entra Privileged Identity Validator v4.1

Validates one exact privileged Microsoft Entra directory object by tenant-local Object ID. It adapts its review to a member user, guest, group, service principal, or managed identity and returns a calibrated Yes, No, or Inconclusive answer to Should We Care?

Inputs:

• Required: <IdentityObjectId>
• Required: <LookbackDays>

What it reviews when supported:

• Exact identity resolution
• Direct, group-based, PIM, permanent, time-bound, and Azure role assignments
• Identity-type-specific ownership, purpose, and governance context
• Bounded direct membership for privileged groups
• User authentication, MFA, passwordless indicators, Conditional Access, and risk context
• Workload credentials and activity for service principals and managed identities
• Sign-ins and audit events
• Evidence completeness, severity calibration, DevOps criteria, and incident criteria

Decision behavior:

• No means no confirmed governance or technical deficiency and no compromise indicator; routine recertification may still apply.
• Yes requires a specific supported governance concern, technical deficiency, compromise indicator, or clearly defined validation requirement.
• Inconclusive means missing evidence prevents a dependable decision.

PowerShell validation:

• Audit-AllUsersRolePerms.ps1 validates directory-role and Azure RBAC privilege paths.
• get_policies.ps1 validates Conditional Access targeting for a user, including direct and transitive membership context.
• find_disabled_accounts.ps1 validates whether exported users resolve as enabled, disabled, unresolved, or failed.

Creating a promptbook in Microsoft Security Copilot

1. Start from a Security Copilot session containing the prompt you want to reuse.
2. Select the prompt and choose Create promptbook.
3. Provide a name, tags, and description.
4. Paste the complete prompt text.
5. Preserve placeholders in angle brackets with no spaces, such as <LookbackDays>.
6. Verify every placeholder under Inputs you'll need before saving.
7. Save and test the promptbook in a new session.

Parameter text inside the prompt is not enough if the builder does not list the input. Always verify the builder's detected inputs before running the promptbook.

Evidence and safety model

• Scanner or AI output is a lead, not final proof.
• Validate important findings using Microsoft Graph, PowerShell, logs, portals, exports, or direct access testing.
• Missing evidence is not proof of safety and is not proof of risk.
• Not Detected does not mean Confirmed Absent.
• Promptbook output varies with the executing user's Security Copilot role, Entra RBAC, available plugins, retention, and data permissions.
• These promptbooks do not modify tenant configuration or perform remediation.

Versioning

Each file includes a visible workflow version that must match its filename. Increment the version whenever prompt behavior or decision logic changes. Publish the complete updated promptbook rather than a patch.

Contributions

Issues and pull requests are welcome. Contributions should:

• Remain organization-neutral and contain no tenant-specific identifiers or secrets.
• Preserve read-only behavior unless a separate, clearly labeled workflow is proposed.
• Include evidence limitations and deterministic validation guidance.
• Keep input placeholders and visible versions synchronized with filenames.
• Avoid unsupported severity, exploitability, or remediation claims.

Disclaimer

Use these promptbooks only in environments where you are authorized to perform security monitoring and validation. Review all generated conclusions and commands before use. Microsoft Security Copilot output may vary according to permissions, available data, plugins, retention, and model behavior.