Viewing all shared Copilot for Security session results regardless of the recipient's plugin permissions

SC-200 By islever Editorial Last updated

Short answer

E A shared session lets the recipient view all results, including prompts using plugins they lack direct access to.

Question

You have a Microsoft 365 E5 subscription that contains two users named User1 and User2 and uses Microsoft Copilot for Security. From the Copilot for Security portal, User1 starts a session and creates the following prompts: • Prompt1: Provides access to the Entra plugin • Prompt2: Provides access to the Intune plugin • Prompt3: Provides access to the Entra plugin User1 shares the session with User2. User2 does NOT have access to Microsoft Intune. For which prompts can User2 view results during the shared session?
  1. Prompt1 only
  2. Prompt1 and Prompt2 only
  3. Prompt3 only
  4. Prompt1 and Prompt3 only
  5. Prompt1, Prompt2, and Prompt3 Correct Answer

Key Takeaways

When a session is shared, the recipient of the link can view the complete results of that session even for plugins or data sources they do not individually have access to, so the Intune permission gap does not block viewing.

User1 shares a Copilot for Security session (with Entra and Intune plugin prompts) to User2, who lacks Intune access; because a shared session grants the recipient access to view the full session results, User2 can view Prompt1, Prompt2, and Prompt3.

Common mistake: Assuming User2 cannot view the Intune-plugin prompt results because they lack Intune access — shared sessions bypass that per-user plugin permission for viewing already-generated results.

Expert Analysis

Why the Answer Is Correct

In Microsoft Copilot for Security, sharing a session gives the recipient access to the shared session's full results. The documentation states that the recipient of a shared session link can view the results even if they do not have standalone access to the underlying plugin or data, so User2 can view all three prompts, including the Intune-plugin one.

Why the Other Options Are Wrong

Any option that excludes Prompt2 (the Intune-plugin prompt) incorrectly assumes User2's missing Intune access blocks viewing shared results; the shared session model overrides that for viewing.

Community Comment Notes

The community favors E (75 votes). Maxxie23 and 3746356 cite the Copilot for Security authentication documentation, noting the shared-session recipient can view full results without the underlying plugin permissions. Peta_San argues D, but the shared-session viewing model supports E.

Official Reference

https://learn.microsoft.com/en-us/copilot/security/authentication

This link opens the official vendor documentation in a new tab.

Community Votes

E
75%
D
25%

75% of anonymous learners picked answer E. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. Maxxie23 👍 2 Answered E
    Answer is incorrect: https://learn.microsoft.com/en-us/copilot/security/authentication Under Shared sessions: Only the user that creates a session controls which Copilot users can access that session. If you receive a link for a shared session from the session creator, you have access. If you forward that link to someone else, it doesn't grant them access.
  2. 3746356 👍 1 Answered E
    if you have access to devices and policies in Intune, and the Intune plugin is utilized to generate a response that you share, the recipient of the shared session link doesn't need Intune access to view the full results of the session.
  3. Peta_San 👍 1 Answered D
    D is correct

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Creating a Microsoft Sentinel bookmark from the Hunting page to support an incident investigation

S-grade

Identifying Affected Entities in Microsoft Defender XDR Incidents

S-grade

Containing a Defender for Identity pass-the-ticket alert by quarantining only the affected device

S-grade

Limiting Microsoft Defender device discovery to specific onboarded devices by creating a device tag first

S-grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide