Semperis announced a strengthened collaboration with Microsoft as the Semperis Lightning Platform integrates with Microsoft Sentinel and Security Copilot. The field-ready integration uses Microsoft-native building blocks including Azure Functions, DCE/DCR, Log Analytics workspace tables, KQL, Security Copilot, and MCP to bring Lightning into the Microsoft security ecosystem.
With this integration, security teams can access Lightning-derived identity context such as attack paths, Tier 0 exposure, posture indicators, and broader hybrid identity telemetry directly within Microsoft Sentinel. That gives analysts the ability to query, correlate, and act on identity risk without leaving the Microsoft security environment. This milestone builds on Semperis’ long-standing collaboration with Microsoft—including membership in the Microsoft Intelligent Security Association membership and designation as a Microsoft Certified Security Software vendor—as part of a broader effort to help customers protect hybrid identity environments.
Semperis has also built custom Security Copilot agents that operate within the Microsoft security stack using KQL-based tools over Lightning tables in Sentinel. These agents can return structured risk and posture summaries, identify exposed paths and Tier 0 proximity, and answer higher-order questions that help defenders prioritize faster. Because these agents can be published through the Microsoft Security Store, joint customers will be able to discover, deploy, and operate the connector and agents directly from within Microsoft’s ecosystem.
“Security teams do not need more disconnected tools,” said Semperis CEO Mickey Bresman. “They need the identity context that helps them understand what matters, what is exposed, and where to act first. By bringing the Semperis Lightning Platform into Microsoft Sentinel and Security Copilot, we are helping customers operationalize identity risk inside the workflows their SOC teams already trust.”
The Semperis collaboration with Microsoft underscores the importance of protecting the identity fabric, which is the security control plane for organizations adopting agentic AI to accelerate business outcomes.
“AI agents move at machine speed, create new attack paths, and introduce new non-human identities, permissions, and dependencies,” said Alex Weinert, Semperis Chief Product Officer. “That makes identity central to modern attack paths across hybrid environments, but too often that insight lives outside the analyst’s workflow. The Semperis integration changes that by making Lightning data usable inside Sentinel and extending that value through Security Copilot agents that help defenders investigate faster, prioritize better, and stay focused on the risks that matter most.”
“Security teams need identity context within the tools they already use. By integrating Semperis’ Lightning Platform with Microsoft Sentinel and Security Copilot, organizations can help their analysts investigate identity-related risk, prioritize exposure, and respond more effectively across hybrid environments,” said Jesse Kopavi, principal program manager, Microsoft Sentinel at Microsoft.
For organizations standardizing Microsoft security operations, the Semperis integration supports a model in which Sentinel serves as the central analytics and hunting plane while Security Copilot adds an AI-assisted investigation layer on top. Together, this gives defenders both identity depth and platform consistency.
