Microsoft Sentinel

Use a Microsoft Sentinel MCP Tool in Microsoft Security Copilot

4 September 2026Doc update+19 / −14 lines

In brief

The article now identifies the YAML as a plugin descriptor template and directs users to find custom plugins under the Custom section of Manage sources. Title, metadata, formatting, and wording were also updated.

What Defender admins need to know

Administrators have clearer instructions when creating and adding Sentinel MCP tool collections to Security Copilot agents; no action is required.

Summaries are generated from the documentation change itself.

Documentation change

View full page diff

View on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Use anMicrosoft Sentinel MCP tooltools in Microsoft Security Copilot

This article shows you how to add Microsoft Sentinel's Model Context Protocol (MCP) collection of security tools or your own custom tools to your AI agents in Microsoft Security Copilot.

For information about how to get started with MCP tools, see the following articles:

Add a Microsoft Sentinel tool collection

To add a Microsoft Sentinel tool collection during custom agent building, follow these steps:

Select Add tool to open the Tools catalog modal.
In the Add a tool modal, search for and select the tools you want to add from Microsoft Sentinel's collection of MCP tools. For example, search for "entity analyzer" to find the entity analyzer tools.
Select Add selected to add the tools to your agent.

Your agent is now connected with Sentinel's available collection of tools. You can start prompting your agent and use the tools to deliver outcomes.

Custom MCP tools let you build deterministic workflows by prescribing exactly what data agents can reason over. To add your custom tool collection in Security Copilot, follow these steps:

Step 1: Create a YAML file for your tool collection

Use the following YAML file template to create and save your plugin. This YAML defines the collection descriptor for your custom plugin, including its metadata and connection settings. Replace each placeholder value (enclosed in angle brackets) with your collection-specific information, such as the collection name, endpoint URL, and the tools you want to add.

The following YAML is the plugin descriptor template. Customize it with your collection details before uploading it to Security Copilot as a custom plugin.

Descriptor:
  Name: <Name of the collection>
For more information about all the parameters you can add and configure in your YAML file, see [Model Context Protocol (MCP) plugins in Microsoft Security Copilot](/copilot/security/plugin-mcp).

### Step 2: Add the YAML file as a custom plugin

1. Go to the [Security Copilot portal](https://securitycopilot.microsoft.com/) and select the **Sources** icon in the prompt bar.

    ![Screenshot of the prompt bar in Security Copilot with the Sources icon highlighted.](media/sentinel-mcp/custom-copilot-source.png)

    :::image type="content" source="media/sentinel-mcp/custom-copilot-manage-sources.png" alt-text="Screenshot of the Manage sources window in Security Copilot with the Add plugin option highlighted." lightbox="media/sentinel-mcp/custom-copilot-manage-sources.png":::

1. From the drop-down options, specify if you want to make the plugin available to just yourself or anyone in the organization.
1. Select **Security Copilot plugin**, choose the YAML plugin file you created from the template in step 1 of this section, then select **Add**.

    :::image type="content" source="media/sentinel-mcp/custom-copilot-add-plugin.png" alt-text="Screenshot of Add plugin pop-up window in Security Copilot with Security Copilot plugin and Add options highlighted." lightbox="media/sentinel-mcp/custom-copilot-add-plugin.png":::
    :::image type="content" source="media/sentinel-mcp/custom-copilot-toggle-plugin.png" alt-text="Screenshot of Custom plugin option in Security Copilot with the added plugin visible." lightbox="media/sentinel-mcp/custom-copilot-toggle-plugin.png":::

### Step 3: Build an agent using the saved plugin

1. In the Security Copilot portal, go to **Build** and select **Start from Scratch** or open an existing custom agent.
1. In your agent skill, select **Add a tool** and find the custom plugin you added earlier in the **Custom** section in step 2.of **Manage sources**.

    :::image type="content" source="media/sentinel-mcp/custom-copilot-add-tool.png" alt-text="Screenshot of Add a tool option in Security Copilot." lightbox="media/sentinel-mcp/custom-copilot-add-tool.png":::


1. Add the plugin to your agent.

## Related content

- [Tool collection in Microsoft Sentinel MCP server](sentinel-mcp-tools-overview.md)

@@ -1,39 +1,39 @@ ----title: Use a Microsoft Sentinel MCP tool in Microsoft Security Copilot+title: Use a Microsoft Sentinel MCP Tool in Microsoft Security Copilot titleSuffix: Microsoft Security   description: Learn how to add Microsoft Sentinel's Model Context Protocol (MCP) collection of security tools or your own custom tool in Microsoft Security Copilot ms.author: pauloliveria author: poliveria ms.reviewer: macasgra ms.topic: how-to-ms.date: 06/12/2026+ms.date: 07/01/2026 ms.service: microsoft-sentinel ms.subservice: sentinel-platform ai-usage: ai-assisted-ms.custom: msecd-doc-authoring-1014+ms.custom: msecd-doc-authoring-1016  #customer intent: As a security analyst, I want to add Sentinel MCP tools in Microsoft Security Copilot. --- -# Use an MCP tool in Microsoft Security Copilot+# Use Microsoft Sentinel MCP tools in Microsoft Security Copilot --This article shows you how to add Microsoft Sentinel's Model Context Protocol (MCP) [collection of security tools](sentinel-mcp-tools-overview.md#available-collections) or your own custom tools to your AI agents in [Microsoft Security Copilot](/copilot/security/microsoft-security-copilot). +This article shows you how to add Microsoft Sentinel's Model Context Protocol (MCP) [collection of security tools](sentinel-mcp-tools-overview.md#available-collections) or your own custom tools to your AI agents in [Microsoft Security Copilot](/copilot/security/microsoft-security-copilot).  For information about how to get started with MCP tools, see the following articles:+ - [Get started with Microsoft Sentinel MCP server](sentinel-mcp-get-started.md) - [Create and use custom Microsoft Sentinel MCP tools](sentinel-mcp-create-custom-tool.md)  ## Add a Microsoft Sentinel tool collection ->[!IMPORTANT]->You need to build your own custom Security Copilot agent before you can add Sentinel's collection of MCP tools. For more information, see [Build an agent from scratch using the lite experience](/copilot/security/developer/create-agent-dev#steps-to-create-your-custom-agent).+> [!IMPORTANT]+> You need to build your own custom Security Copilot agent before you can add Sentinel's collection of MCP tools. For more information, see [Build an agent from scratch using the lite experience](/copilot/security/developer/create-agent-dev#steps-to-create-your-custom-agent).  To add a Microsoft Sentinel tool collection during custom agent building, follow these steps:  1. Select **Add tool** to open the Tools catalog modal.-1.	In the **Add a tool** modal, search for and select the tools you want to add from Microsoft Sentinel's collection of MCP tools. For example, search for "entity analyzer" to find the entity analyzer tools.-1.	Select **Add selected** to add the tools to your agent.+1. In the **Add a tool** modal, search for and select the tools you want to add from Microsoft Sentinel's collection of MCP tools. For example, search for "entity analyzer" to find the entity analyzer tools.+1. Select **Add selected** to add the tools to your agent.  Your agent is now connected with Sentinel's available collection of tools. You can start prompting your agent and use the tools to deliver outcomes. @@ -41,9 +41,12 @@ Your agent is now connected with Sentinel's available collection of tools. You c  Custom MCP tools let you build deterministic workflows by prescribing exactly what data agents can reason over. To add your custom tool collection in Security Copilot, follow these steps: -### Step 1: Create a YAML file for your tool collection +### Step 1: Create a YAML file for your tool collection+ Use the following YAML file template to create and save your plugin. This YAML defines the collection descriptor for your custom plugin, including its metadata and connection settings. Replace each placeholder value (enclosed in angle brackets) with your collection-specific information, such as the collection name, endpoint URL, and the tools you want to add. +The following YAML is the plugin descriptor template. Customize it with your collection details before uploading it to Security Copilot as a custom plugin.+ ```yaml Descriptor:   Name: <Name of the collection>@@ -64,6 +67,7 @@ SkillGroups: For more information about all the parameters you can add and configure in your YAML file, see [Model Context Protocol (MCP) plugins in Microsoft Security Copilot](/copilot/security/plugin-mcp).  ### Step 2: Add the YAML file as a custom plugin+ 1. Go to the [Security Copilot portal](https://securitycopilot.microsoft.com/) and select the **Sources** icon in the prompt bar.      ![Screenshot of the prompt bar in Security Copilot with the Sources icon highlighted.](media/sentinel-mcp/custom-copilot-source.png)@@ -72,7 +76,7 @@ For more information about all the parameters you can add and configure in your      :::image type="content" source="media/sentinel-mcp/custom-copilot-manage-sources.png" alt-text="Screenshot of the Manage sources window in Security Copilot with the Add plugin option highlighted." lightbox="media/sentinel-mcp/custom-copilot-manage-sources.png"::: -1. From the drop-down options, specify if you want to make the plugin available to just yourself or anyone in the organization. +1. From the drop-down options, specify if you want to make the plugin available to just yourself or anyone in the organization. 1. Select **Security Copilot plugin**, choose the YAML plugin file you created from the template in step 1 of this section, then select **Add**.      :::image type="content" source="media/sentinel-mcp/custom-copilot-add-plugin.png" alt-text="Screenshot of Add plugin pop-up window in Security Copilot with Security Copilot plugin and Add options highlighted." lightbox="media/sentinel-mcp/custom-copilot-add-plugin.png":::@@ -82,8 +86,9 @@ For more information about all the parameters you can add and configure in your     :::image type="content" source="media/sentinel-mcp/custom-copilot-toggle-plugin.png" alt-text="Screenshot of Custom plugin option in Security Copilot with the added plugin visible." lightbox="media/sentinel-mcp/custom-copilot-toggle-plugin.png":::  ### Step 3: Build an agent using the saved plugin+ 1. In the Security Copilot portal, go to **Build** and select **Start from Scratch** or open an existing custom agent.-1. In your agent skill, select **Add a tool** and find the custom plugin you added in the **Custom** section in step 2.+1. In your agent skill, select **Add a tool** and find the custom plugin you added earlier in the **Custom** section of **Manage sources**.      :::image type="content" source="media/sentinel-mcp/custom-copilot-add-tool.png" alt-text="Screenshot of Add a tool option in Security Copilot." lightbox="media/sentinel-mcp/custom-copilot-add-tool.png"::: @@ -91,6 +96,6 @@ For more information about all the parameters you can add and configure in your  1. Add the plugin to your agent.  - ## Related content+ - [Tool collection in Microsoft Sentinel MCP server](sentinel-mcp-tools-overview.md)