Terraform MSGraph Security Copilot Utils

Experimental wrapper over the Microsoft Security Copilot APIs: the Azure compute capacity (Microsoft.SecurityCopilot/capacities, via azapi) and the beta Microsoft Graph security/securityCopilot data-plane (workspaces, plugins, sessions, prompts, evaluations, via the Microsoft/msgraph provider), with a beta/v1.0 toggle. Supersedes terraform-azapi-security-copilot-compute-capacity by folding its capacity resource in here.

Status: core, experimental, untested. Security Copilot's Graph surface is beta and a loose fit for Terraform's desired-state model (sessions, prompts and evaluations are conversational and largely append-only). This is published as a starting point to explore the endpoints; it has not been run against a live tenant (needs a Security Copilot provisioned tenant with SCU capacity and the security Graph permissions). CI and release are held until it can be tested. A hand-written client (for example Python) may end up the better long-term fit.

---

Shape of the API

Everything on the Graph side hangs off a workspace (default "default"):

security/securityCopilot/workspaces/{workspace_id}
  /plugins
  /sessions/{session_id}
    /prompts/{prompt_id}
      /evaluations/{evaluation_id}

Creating a prompt does not start AI reasoning; creating an evaluation on that prompt does. Poll the evaluation output for results.

Inputs at a glance

Input	Operation	Provider / resource
compute_capacity	deploy SCU capacity (ARM)	azapi Microsoft.SecurityCopilot/capacities
plugins	manage a plugin under a workspace	msgraph_resource
sessions / session_updates	create / update a session	msgraph_resource / msgraph_update_resource
prompts	create a prompt in a session (by session_key or session_id)	msgraph_resource
evaluations	create an evaluation on a prompt (by *_key or *_id)	msgraph_resource
resources	any other endpoint by raw url	msgraph_resource

Prompts and evaluations can chain within one apply: reference a session/prompt created here by its map key (session_key / prompt_key) and the module resolves the created id and builds the URL.

Minimum permissions

Graph application permissions (admin-consented) on a Security Copilot tenant, plus an Azure role (for example Owner/Contributor on the resource group) for the capacity:

Feature	Minimum permission
Workspaces / sessions / prompts / evaluations	SecurityCopilotWorkspaces.ReadWrite.All (read variants for read-only)
Compute capacity (ARM)	Azure RBAC on the resource group, plus the Microsoft.SecurityCopilot provider registered

Examples

• examples/minimal - create one session in the default workspace.
• examples/complete - capacity, a plugin, and a chained session, prompt and evaluation.

Requirements

Name	Version
terraform	>= 1.9.0, < 2.0.0
azapi	>= 2.0.0, < 3.0.0
msgraph	>= 0.1.0, < 1.0.0

Providers

Name	Version
azapi	>= 2.0.0, < 3.0.0
msgraph	>= 0.1.0, < 1.0.0

Modules

No modules.

Resources

Name	Type
azapi_resource.compute_capacity	resource
msgraph_resource.evaluations	resource
msgraph_resource.plugins	resource
msgraph_resource.prompts	resource
msgraph_resource.resources	resource
msgraph_resource.sessions	resource
msgraph_update_resource.session_updates	resource

Inputs

Name	Description	Type	Default	Required
compute_capacity	Security Copilot compute capacities (Microsoft.SecurityCopilot/capacities) to deploy, keyed by a stable logical name. This is an Azure (ARM) resource managed through azapi, distinct from the Graph data-plane resources below. Verify azapi_version against the current provider API version.	map(object({ resource_group_id = string name = string location = string number_of_units = optional(number, 1) geo = optional(string) cross_geo_compute = optional(string) overage_state = optional(string) overage_amount = optional(number) azapi_version = optional(string, "@2024-08-01-preview") tags = optional(map(string)) schema_validation_enabled = optional(bool, false) response_export_values = optional(list(string)) ignore_missing_property = optional(bool, true) ignore_null_property = optional(bool, true) ignore_casing = optional(bool, false) }))	{}	no
default_api_version	Default Microsoft Graph API version for the Security Copilot operations. The Security Copilot Graph surface currently exists only on beta, so this defaults to "beta". It is exposed as a flag so it can be moved to "v1.0" (or pinned per entry) once the API graduates.	string	"beta"	no
evaluations	Security Copilot evaluations to create under a prompt, keyed by a stable logical name. Creating an evaluation starts the AI reasoning over its prompt. Reference the parent session with exactly one of session_key or session_id, and the parent prompt with exactly one of prompt_key or prompt_id. POST .../sessions/{session}/prompts/{prompt}/evaluations.	map(object({ body = optional(any, {}) workspace_id = optional(string, "default") session_key = optional(string) session_id = optional(string) prompt_key = optional(string) prompt_id = optional(string) api_version = optional(string) update_method = optional(string) response_export_values = optional(map(string)) }))	{}	no
plugins	Security Copilot plugins to manage under a workspace, keyed by a stable logical name. url built as security/securityCopilot/workspaces/{workspace_id}/plugins. body is the plugin object.	map(object({ body = any workspace_id = optional(string, "default") api_version = optional(string) update_method = optional(string) response_export_values = optional(map(string)) }))	{}	no
prompts	Security Copilot prompts to create under a session, keyed by a stable logical name. Reference the parent session with exactly one of session_key (a key in var.sessions, resolved to its created id) or session_id (a raw id). POST .../sessions/{session}/prompts. body is the prompt object (for example a content block).	map(object({ body = any workspace_id = optional(string, "default") session_key = optional(string) session_id = optional(string) api_version = optional(string) update_method = optional(string) response_export_values = optional(map(string)) }))	{}	no
resources	Generic passthrough for any other Security Copilot (or wider Graph) resource with full CRUD, keyed by a stable logical name. url is the resource path (for example "security/securityCopilot/workspaces"). Use this to reach endpoints without a first-class input.	map(object({ url = string body = any api_version = optional(string) update_method = optional(string) response_export_values = optional(map(string)) }))	{}	no
session_updates	Existing Security Copilot sessions to update (PATCH) by id, keyed by a stable logical name.	map(object({ session_id = string body = any workspace_id = optional(string, "default") api_version = optional(string) response_export_values = optional(map(string)) }))	{}	no
sessions	Security Copilot sessions to create under a workspace, keyed by a stable logical name. POST security/securityCopilot/workspaces/{workspace_id}/sessions. Reference a created session from prompts by this key. body is the session object (for example title, evaluationSettings).	map(object({ body = any workspace_id = optional(string, "default") api_version = optional(string) update_method = optional(string) response_export_values = optional(map(string)) }))	{}	no

Outputs

Name	Description
compute_capacities	Map of capacity key to its id and exported response values.
compute_capacity_ids	Map of capacity key to the Azure resource id of the Security Copilot capacity.
evaluation_ids	Map of evaluation key to its Graph resource id.
evaluations	Map of evaluation key to its resource url and exported response values (poll these for AI results).
plugin_ids	Map of plugin key to its Graph resource id.
prompt_ids	Map of prompt key to its Graph resource id (use these, or the prompt_key, to attach evaluations).
resources	Map of generic passthrough key to its id, resource url and exported response values.
session_ids	Map of session key to its Graph resource id (use these, or the session_key, to attach prompts).
sessions	Map of session key to its resource url and exported response values.