Learning path
Microsoft Security Copilot - Promptbooks and Workflow Automation
Skill Level
Fundamentals
Duration 10 minutes
Updated Nov 5, 2026
About this learning path
Every analyst has a favorite way to work an incident, and most of it lives in their head. Microsoft Security Copilot promptbooks capture that routine as an ordered series of prompts anyone can run with one input. Learn to build and share one, connect it to Azure Logic Apps in both directions, and put guardrails in place before you automate.
Your instructors
Prerequisites
- Prompting basics: Comfort writing a clear prompt with a goal, context, expectations, and source.
- Alerts and incidents: A working idea of how a SOC triages alerts and incidents in the Microsoft Defender portal.
- Roles and permissions: A high-level view of Microsoft Entra roles and Azure role-based access control, so you can see why access shapes what a promptbook returns.
- Workflow basics: What a trigger and an action are in Azure Logic Apps. Helpful for the automation sections, and not required to build a promptbook.
What you'll learn
- Choose between prompts, promptbooks, and agents for a security task
- Run a ready-made promptbook and supply the input it needs
- Build a custom promptbook from a session you trust
- Add parameters and share a promptbook with your team
- Connect promptbooks and agents to Azure Logic Apps in both directions
- Apply access, capacity, and review guardrails before you automate