Microsoft Copilot

• A Global Administrator within your Microsoft Entra ID environment.

• A Global Administrator or Power Platform Administrator role within your Microsoft Entra ID environment.

• A registered application called Tenable within your Microsoft Entra ID environment.

Register your Application and Add API Permissions

1. Log in to Microsoft Entra ID.

2. In the left navigation menu, click Entra ID > App registrations.

3. Click New registration.

   The Register an application window appears.

   

4. In the Name text box, type Tenable.

5. Click Register.

   Microsoft Entra ID creates and registers the application. You navigate to the App registration page.

6. In the left navigation menu, click API permissions.

   

7. Click Add a permission.

   The Request API permissions page appears.

8. Click Microsoft Graph.

   The configuration options appear.

   

9. In the What type of permissions does your application require? section, select Application Permissions.

10. In the Select permissions section, search for and select the following permissions:

    • AiEnterpriseInteraction.Read.All” and its relevant checkbox

    • "AuditLog.Read.All", and its relevant checkbox

    • "Group.Read.All”, and its relevant checkbox

    • "User.Read.All", and its relevant checkbox

    • "Mail.Read", and its relevant checkbox

11. Click Add permissions.

12. In the Configured permissions section, click Grant admin consent for Default Directory.

    

Add a Client Secret

1. On the page for your Tenable application, navigate to Certificates & secrets > New client secret.

   The Add a client secret window appears.

   

2. In the Description text box, type a name for the client secret.

3. From the Expires drop-down, select the time frame after which you want the client secret to expire.

4. Generate and copy the following value:

   • Secret value

5. In the left navigation menu, click Overview.

   

6. In the Essentials section, copy the following values:

   • Application (client) ID

   • Directory (tenant) ID

Copy Environment URL and Create Security Role

1. Log in to the Power Platform admin center.

2. In the left navigation bar, select Manage.

   

   The Manage page appears.

3. Navigate to Environments > Default Directory.

   

   The environment details appear.

4. Copy the Environment URL.

5. Within this environment, navigate to Settings > Users + permissions > Security roles.

   

6. Click New role.

   The Create New Role window appears.

   Note:You must be a member of the Microsoft Entra ID environment to perform this step. You can verify that you are a member on the environment details page. If you are not a member, in the upper-right corner of the environment details page, select Membership and add yourself as a member.
   

   

7. In the Role Name text box, type Tenable-copilot-agents-read.

8. In the Business Unit section, select a business unit from the list or create a new one. Then, copy the value for future use.

   To create a new business unit:-

   1. In the selected environment, navigate to Settings > Users + permissions > Business Unit.

   2. Click Add new business unit.

9. In the Description, Applies to, and Summary of Core Table Privileges boxes, provide any text that fits your use case.

   Note: These Microsoft metadata fields describe the security role. These fields do not affect the permissions.

10. From the Member's privilege inheritance drop-down, select Direct User (Basic) access level and Team privileges.

11. Select the Include App Opener privileges for running Model-Driven apps check box.

12. Click Save.

13. Navigate to Settings > Security roles and select the role you created.

    Note: This page might appear automatically after you create the role.

14. Add the role to the following permissions:

    • Copilot — Read

    • Copilot Interactions — Read

    • Copilot Component — Read

    • Copilot component collection — Read

    • AICopilot — Read

    If you do not see all permissions, make sure that you select show all tables as your display settings.

    

    Note: Be sure to save the permissions at the organizational level.

15. Click Save.

Create an Application User

1. In the selected environment, navigate to Settings > Users + permissions > Application users.

2. Click Create new app user.

   The Create a new app user window appears.

   

3. In the App section, select the Tenable app you previously created and registered.

4. In the Business Unit section, select the same business unit you used when configuring the selected security role.

5. In the Security roles section, select the Tenable-copilot-agents-read role you previously created.

6. Click Create.