Security Incident Response and Co-pilot

[Barry11]

Our Cybersecurity team uses ServiceNow Security Incident Response (SIR) on the Australia release and would like to use Microsoft 365 Copilot Premium to query SIR data for incident summaries, trend analysis, reporting, and executive insights. What out-of-the-box integrations, connectors, MCP servers, or Copilot Studio capabilities are currently available to support this use case, and what is the recommended implementation approach?

[craig15miller]

To query ServiceNow Security Incident Response (SIR) data using Microsoft Copilot, leverage the native ServiceNow SIR plugin for Microsoft Security Copilot (which facilitates cross-platform AI-to-AI communication for incident summaries and correlation insights) alongside the ServiceNow Tickets M365 Copilot connector for indexing operational records. For advanced custom reporting and trend analysis, deploy Copilot Studio integrated with ServiceNow’s built-in Model Context Protocol (MCP) Server Console (native to the Australia release) to establish secure, governed API-driven data retrieval. The recommended implementation approach is to configure OAuth authentication between your ServiceNow instance and Microsoft Security Copilot for out-of-the-box security workflows, while utilizing Copilot Studio and MCP agents to orchestrate complex, multi-table executive trend analytics and custom reporting dashboards.

[musislam · Accepted solution]

Hi @Barry11 ,

One thing to clarify first: the ServiceNow SIR plugin is built for Microsoft Security Copilot, which is a separate product from Microsoft 365 Copilot Premium. Your M365 Copilot licence doesn't include it.

For M365 Copilot, here are your options:

1. Copilot Studio + ServiceNow MCP Server Console (recommended)
   Publish SIR data as governed tools, such as Scripted REST APIs or Now Assist skills that summarise or aggregate sn_si_incident. Then connect them to a Copilot Studio agent that's published to M365 Copilot. This is the best fit for trend analysis and executive reporting.
   • Use OAuth authorization code grant with the JWT token format. The default format fails silently.
   • Calls run under the OAuth integration user's credentials, not the signed-in user's. Scope that user's roles tightly.
   • Tutorial: Quick Tutorial: Copilot Studio Agent with SN MCP Server 
2. ServiceNow Tickets Microsoft 365 Copilot connector
   This indexes task-based tables, and incident is the default. SIR isn't documented as supported. More importantly, the connector doesn't enforce ServiceNow ACLs, so it's risky for security incident data. See ServiceNow Tickets connector overview.
3. Security Copilot SIR plugin
   Only worth it if your security team already licenses Security Copilot. It works one incident at a time (details, summary, correlation insights), not trends. See ServiceNow SIR and Microsoft Security Copilot.

For production, put AI Control Tower / AI Gateway in front of the MCP server for auditing and governance.

A small request from my end, If you like this opinion and your problem is resolved after reviewing and applying it. Please kindly mark this your best answer‌🌠‌  if you think that you get some insight from this content relevant to your problem and help me to contribute more to this community