You use Microsoft Security Copilot.

Select Owners only for custom plugins at the workspace scope . Microsoft Security Copilot distinguishes between plugins that users manage for their own sessions and plugins published for broader organizational or workspace use. Because the requirement concerns plugins that can affect all users , the relevant governance boundary is the workspace-level setting rather than the user-level setting. Microsoft states that Security Copilot owners control plugin settings and can determine who is allowed to add and manage custom plugins for everyone in the organization. By default, owners have this administrative capability.

Allowing Contributors and Owners at workspace scope would permit contributors to publish plugins that affect other users, directly violating the requirement. Selecting Owners only at user scope would restrict personal plugin management but would not specifically enforce who can publish or manage plugins for the wider workspace.

This follows least-privilege governance: Contributors can perform normal Security Copilot investigations, while Owners retain administrative capabilities that affect shared configuration. Microsoft’s SC-500 study guide explicitly includes configuring Security Copilot workspaces, managing Security Copilot permissions and roles, and enabling and configuring plugins within the Manage and monitor security posture domain.

===============