You use Microsoft Security Copilot. Security Copilot contributors currently create custom plugins for their own sessions and manage organization-wide…

The objective is to prevent Security Copilot contributors from managing organization-wide plugins while allowing them to manage plugins for their own sessions. Microsoft Security Copilot uses role-based access control at two distinct scopes for custom plugin management: tenant scope (organization-wide) and user scope (for their own sessions).

To achieve the desired outcome, you must configure the tenant scope setting to permit only users with the 'Owner' role to manage these shared plugins. Selecting "Owners only at the tenant scope" directly enforces this restriction at the organizational level, thereby preventing contributors from managing these plugins. This change does not affect the user scope settings, so contributors retain their ability to create and manage plugins for personal use.

A. Contributors and Owners at the tenant scope: This is the permissive default setting that allows contributors to manage organization-wide plugins, which is what needs to be changed.

B. Owners only at the user scope: This incorrectly restricts contributors from creating plugins for their own sessions, which violates a specific requirement of the solution.

C. Contributors and Owners at the user scope: This setting correctly allows contributors to manage their own plugins but fails to address the primary requirement of restricting their access to organization-wide plugins.

1. Microsoft Learn

"Manage plugins in Microsoft Security Copilot": This document details the plugin management settings. Under the section "Manage who can create custom plugins

" it explicitly states the two scopes:

User scope: "These plugins are only available to the user who created them."

Tenant scope: "These plugins are available to all users in the organization."

It further explains the permission options for each scope: "Owners only" or "Contributors and Owners." To restrict tenant-level management

the "Tenant scope" must be set to "Owners only."

Source: Microsoft. (n.d.). Manage plugins in Microsoft Security Copilot. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/security-copilot/manage-plugins#manage-who-can-create-custom-plugins

2. Microsoft Learn

"Roles and authentication in Microsoft Security Copilot": This document defines the capabilities of the Owner and Contributor roles. It clarifies that Owners have full permissions

including managing all settings

while Contributors have more limited access. Restricting tenant-level plugin management to Owners aligns with this principle of least privilege.

Source: Microsoft. (n.d.). Roles and authentication in Microsoft Security Copilot. Microsoft Learn. Retrieved from https://learn.microsoft.com/en-us/security-copilot/roles-authentication#security-copilot-roles