michaelsendpoint.com

Appearance

Change Review Agent ​

👋 Introduction ​

Now that Security Copilot slowly gets activated in all M365 E5 tenants, people get access to all the great Security Copilot Agents. The Change Review Agent is one of these agents, that helps you analyze Multi Admin Approval requests for PowerShell scripts. This should help admins get an idea what these scripts are all about without needing to be a PowerShell expert themselfs.

To give a recommendation about a request, the agent does not only analyzes the script itself, it also analyzes signals from Defender Vulnerability Management, Entra ID and Intune.

Prerequisites ​

Required licenses (all included in Microsoft 365 E5):

  • Microsoft Intune Plan 1 subscription
  • Microsoft Entra ID P2
  • Microsoft Defender Vulnerability Management
  • Microsoft Security Copilot

Security Copilot plugins:

  • Microsoft Intune
  • Microsoft Entra
  • Microsoft Defender XDR
  • Microsoft Threat Intelligence

To enable the Change Review Agent:

  • Intune Administrator (Entra role)
  • Security Reader (Entra role)
  • Entra/Identity risky user (read) (Entra permission)
  • Security Reader (Entra role)
  • Copilot owner (Security Copilot role)

To use the agent:

  • Read Only Operator or custom role with equivalent permissions (Intune role)
  • Security Reader (Entra role)
  • Use of the agent requires the same access as enabling and configuring the agent (Defender role)
  • Copilot contributor (Security Copilot role)

INFO

The agent is currently only supported on the public cloud.

How the agent works ​

During each run the agent basically does these same steps:

  1. Signal aggregation
    • Threat insights (Defender Vulnerability Management)
    • Identity risk (Entra ID)
    • Multi Admin Approval requests and historical context of similar requests (Intune)
  2. Evaluation
    • Built-in agent logic evaluates the PowerShell scripts.
  3. Recommendations
    • The agent processes up to 10 requests per run.

Agent identity

The agent uses the identity and permissions of the admin that provisioned the agent in the first place. Every time you run it, the identity refreshes. If the agent is inactive for 90 consecutive days, authentication expires and runs will fail.

drawing

🧑‍💻 Admin Experience ​

To get started you can provision the agent either in the Intune admin portal or the Security Copilot portal. I use the Intune admin portal in this example. If you want to know how to do it through the Security Copilot portal look here.

First set up ​

  1. Open the Intune admin center and select the Agents blade from the left menu.
  2. When select to View details and you never started the agent before, you get the possebilities to set up the agent.

INFO

If you never started the agent before, you will see a banner alerting you to your access.

  1. Next you just click Set up agent.
  1. Once the agent has been set up, you will see all associated information again, including roles, plugins, and other infos. From there, you can launch the agent for the first time with Start agent.
  1. After this you will see the results in the Overview tab.

Working with the agent ​

When opening the agent via the Agents tab in Intune you find 3 tabs. Here, you can also manually start or remove the agent.

Overview

On this tab you can check the agent's current status, see top Multi-Admin Approval requests and view recent activity.

  • Agent status: Shows agent's details, availability and current status.
  • Agent suggestions: Here you see the top approval requests.
  • Activity: Shows a limited history of agent run's.

Suggestions

On this tab you'll find the full list of recommended approval requests.

  • Risk threshold: Shows the agents assessment of the change request.
  • Resource type: Shows the type of request (e.g. PowerShell script).
  • Requested by: Shows the user that used the agent.
  • Approval expiration: Shows when the request expires if you don't act.
  • Status: Current status of the request.

INFO

If there are no sripts to analyze, running the agent will not cost any capacity.

Settings

On this tab you find the agent's preset configuration information and the identity used by the agent.

  • Agent jobs: Explains what the agent can do.
  • Required permissions: Shows the permission the agent uses.
  • Identity: Shows the user account the agent uses as its identity. This is the only setting that can be changed.
  • Plugins: Shows the plugins the agent uses during evaluation.

Multi Admin Approval ​

You can also access agent suggestions directly on the Multi-Admin Approval page, when in the process of approving a script.

  1. Go to the My requests or All requests tab.
  2. Look for available suggestions in the Agent Response column.
  3. Click the suggestion to open and finish the approval workflow or start the Change Review Agent in general with Run Change Review Agent.

Check agent suggestions ​

In the Suggestions tab you will find a list of the suggstions found by your runs.

In the list you will directly see what the suggestion is, what the risk threshold is and the current Status if something was already done with this suggenstion and if so, what.

The agent can make the following suggestions:

  • Approve: Low-risk request, safe to approve.
  • Reject: High-risk request, not safe to approve.
  • Needs more info: Risk couldn't be fully assessed, requires admin review.

When opening a suggestion, you will get an in depth explanation of how the agent came to his suggestion and all other information available.

When you click View Request you will see a flyout with the specific information about the request, like the time, user, justification or code. Here you can also directly Complete request or Cancel request from the agent.

Your decission will be timestamped and available for later review.

Agent logs ​

Security Copilot logs capture all agent management actions and permission failures. However, they do not record recommendation details or completion times.

Common errors ​

  • Inaccurate Suggestions The agent may need more data or adjusted settings. You can also help by providing likes/dislikes to suggestions.
  • Access Denied (Licensing) Your account is missing required licenses or plugins.
  • Access Denied (Workspace) You aren't a member of the required Security Copilot workspace.
  • Access Denied (Permissions) Your account lacks the necessary roles.
  • Failed Run / Execution Stopped The agent's account authorization most likely expired (e.g. hit the 90-day limit or had a token revoked).
    • Reauthorizing requires removing and reinstalling the agent, which permanently deletes all existing suggestions.
  • Unable to Retrieve Details Run your request again, this should pass on it's own.
  • Unsupported Request The request was blocked for violating Microsoft's Responsible AI policies (such as a detected prompt injection attempt).

💡 Conclusion ​

The Change Review Agent an especially helpful agent, for people who do need to check a lot of scripts or don't don't now powershell well enough. It makes Multi-Admin Approval requests easier and quicker to understand, helps admins assess risk faster and turns complex scripts into a simple read.

References