Security Copilot in Intune is now GA and brings an exciting new feature

A while ago, I took a look at what Security Copilot could do for you in Intune and how you can set it up, while it still was in public preview: Getting started with Intune Copilot – Mike’s MDM Blog

Today I want to focus on, how it looks now and also highlight the new Explorer feature that came with GA. Initial setup has not really changed, so I would suggest to check out my older post for that. The overall experience has not changed much, we can still ask for help with our devices:

And we still have the familiar flyout plane with our predefined prompts available:

Explorer

The new big thing is the introduction of the new “Explorer” feature, which lets you easily query the Intune data platform:

The feature works similar to the Multi device query, but instead of asking you a KQL query to get your data from the tables, we now have the possibility to select from a huge list of predefined questions, like show me the latest quality updates:

Or a summarization of my devices by OS Version.

As you can see, every result will have a Copilot summary available, suggesting to you what you can do with the data, or what other queries may be helpful for you:

Variables

Many questions also allow you to specify more details, like show me all devices where a specific user is singed in:

Here it will present you with a nice user selection, when you click on the user field:

Once selected, we can get a list of devices where I’m logged in:

APPS

The search is not limited to devices, nearly all data available in the Intune data platform can be used, here I wanted to see the different versions of 7-zip that were discovered on my Windows devices: (Maybe I should start updating 7-zip in my test lab… :))

EXAMPLES

It also has a lot of helpful examples to get started with the new explorer:

These give you an easy way to begin, however I found it easier to just start typing and see what appears for my query:

ACTIONS

Depending on your result, you may also see an option to directly take action. If I for example list all devices that I have enrolled, it gives me the option to add these devices to an Entra ID group of my choice:

I can choose between an existing group:

Or I can simply create a new group from here and add my selected devices:

And with just one click, I now have a Group with all my devices, that I can now use to assign apps or policies or whatever I want.

Conclusion

The new Explorer feature is a really cool addition to the existing copilot experience in Intune, and can make it much easier for a non-tech Intune admin to get to the information they need, without having the need to export the data and use something like Power Bi just to get the data. Also the new actions are a real gamechanger in my option, as they allow for a simple and quick group creation process for one of these days, where you just need a group of devices that matches a specific criteria that is simply not available as dynamic group or filter, no more need for complicated Graph API PowerShell scripts for a one of action.