Prompt Engineering for Security Copilot in Microsoft Purview: Get Precise Answers Every Time

Introduction

The difference between a useful Security Copilot response and a useless one comes down to how you ask the question. A vague prompt returns hundreds of irrelevant results. A well-structured prompt returns exactly what you need, with source links you can verify. I have been using Copilot in Purview investigations since early preview, and after hundreds of queries, I can tell you exactly what works, what does not, and why.

This guide is a practical reference for writing Copilot prompts that return precise, actionable results. It is not about theory. Every example comes from real investigations I have run – DLP alerts, insider risk cases, eDiscovery searches, and compliance posture queries. If you are new to Copilot, start with the Security Copilot guide for an overview of what it can do. This guide focuses specifically on how to talk to it.

The Four-Part Prompt Structure That Works Every Time

Every effective Copilot prompt has four components. You do not always need all four, but the more you include, the more precise the response. The structure is: action (what you want Copilot to do), subject (who or what you are asking about), scope (the time window or location), and filters (severity, data type, or other constraints).

A complete prompt following this structure looks like: “Summarise the DLP alerts for user j.smith in the past 7 days where credit card data was sent to external domains.” Action: summarise. Subject: DLP alerts for j.smith. Scope: past 7 days. Filters: credit card data, external domains. This prompt returns a handful of targeted results. Compare it to the vague version: “Show me DLP alerts.” That returns everything – hundreds of alerts across all users, all time periods, all data types.

When you are investigating an incident, start with all four components. If the results are too narrow, remove one filter and re-query. If they are too broad, add another filter. Think of Copilot as a search engine for your compliance data – the quality of the query determines the quality of the results. The audit log search guide uses the same principle: specific queries return specific results. Copilot just lets you write them in plain English instead of filter syntax.

Prompt Templates for Every Investigation Type

Here are the prompt patterns I use most often, organised by investigation type. Each is a starting template – replace the names, dates, and data types with your own.

DLP alert investigation. “Summarise the DLP alert [alert ID] and show me all activity for [user] in the 24 hours before and after it fired. Filter to external recipients only.” This returns the alert details plus a timeline of surrounding activity, so you can see whether the alert was part of a larger pattern.

Insider risk investigation. “Show me all alerts for [user] from the past 30 days, grouped by policy. Include their risk score trend over that period.” The risk score trend is the most valuable part – a user whose score is steadily climbing is worth investigating even if no single alert crossed the threshold.

Compliance posture query. “How many documents with a [label name] sensitivity label were shared externally in [month]? Break it down by department.” This is the kind of question that previously required exporting data and building a pivot table. Copilot answers it in seconds. Use it for board reports and monthly compliance reviews.

Audit log investigation. “Show me every file downloaded by [user] from [SharePoint site] in the past 48 hours. Include the file names and download times.” Copilot queries the unified audit log directly and formats the results as a readable timeline. For complex searches, you can chain prompts – ask for the downloads first, then follow up with “Were any of those files forwarded externally?”

Policy generation. “Create a DLP policy that blocks emails containing [sensitive info type] sent to external recipients, with a policy tip warning the user. Scope to Exchange and apply to all users.” Copilot generates the policy configuration. Review every setting before activating – Copilot handles about 80% of the work, but the remaining 20% is checking its assumptions about thresholds, exclusions, and notification settings.

Common Prompt Mistakes and How to Fix Them

After watching dozens of analysts use Copilot for the first time, I see the same mistakes repeatedly. Each one is easily fixed once you know what to look for.

Being too vague. “Show me alerts” returns everything. “Show me high-severity DLP alerts for j.smith this week” returns a handful of targeted results. If your prompt could apply to a hundred different scenarios, it will return a hundred different results. Add specificity until the scope feels narrow enough to be useful.

Omitting the time window. Copilot defaults to a standard time range, and that range may not match your investigation. Always specify the time window explicitly – “in the past 24 hours,” “this month,” “between Monday and Wednesday.” A prompt without a time window is a prompt that returns irrelevant historical data alongside what you actually need.

Asking for too much in one prompt. “Show me all DLP alerts, all insider risk alerts, and all audit log activity for j.smith” will return an unmanageable wall of data. Break complex investigations into a sequence of focused prompts. Start broad to understand the landscape, then narrow each follow-up query to drill into what matters. This chaining approach mirrors how you would use the audit log manually – filter, review, filter again.

Not verifying sources. Every Copilot response includes links to the underlying data. If you do not click those links, you are trusting a generative AI model with compliance decisions. Copilot can and does make mistakes. It can misattribute an action to the wrong user, misreport a timestamp, or summarise a document in a way that changes its meaning. The prompt got you to the data. The links verify whether the summary is accurate. Never skip this step.