MMicrosoft Security Copilot

Companies on Microsoft 365 E5 or E7 now get 400 Security Compute Units of Microsoft Security Copilot each month for every 1,000 licensed users, up to 10,000 units, at no extra cost. Security Copilot is Microsoft’s generative AI assistant and agent platform for security and IT teams, used to triage alerts, investigate incidents, analyze scripts, tighten identity policies and write reports.

It draws on Microsoft’s threat intelligence, which the company says covers more than 100 trillion daily signals, and works inside Defender, Sentinel, Entra, Intune and Purview as well as in a standalone portal.

How It Works

Analysts ask questions in plain language or run promptbooks, and Security Copilot pulls data from connected Microsoft and partner tools to summarize incidents, explain malicious scripts and suggest next steps. Agents take on narrower jobs with more independence. The Phishing Triage Agent in Defender sorts user-reported emails, and the Conditional Access Optimization Agent in Entra looks for gaps in Zero Trust policies; other agents handle vulnerability remediation in Intune and data security in Purview. Microsoft added 12 of its own agents and more than 30 partner agents at Ignite 2025, and partner agents are sold through the Microsoft Security Store.

Teams can build custom agents with an Agent Builder, APIs, MCP and Microsoft Graph. Agents are not switched on automatically; an organization has to set them up and deploy them.

Pricing

Security Copilot is metered in Security Compute Units. Organizations outside the E5 inclusion buy provisioned units, reported at $4 per unit per hour, with overage reported at $6. For E5 and E7 customers, the included allowance scales with seats: 400 licenses get 160 units a month and 4,000 get 1,600. Units reset monthly and do not roll over. Microsoft says usage beyond the allowance will be throttled at a future date, after which customers can buy more at $6 per unit with 30 days’ notice. Sentinel data lake costs, Logic Apps charges and partner agent licenses are billed separately.

What to Watch Out For

The product works best for organizations deep in Microsoft’s security stack; teams built around other vendors will get less from it. Compute units are an unfamiliar unit of spend, and heavy agent use can exhaust an included allowance quickly. Microsoft’s headline results, such as finding malicious emails up to 550% faster, come from its own controlled tests. As with any AI assistant, analysts still need to check conclusions before acting on them.

Recent News

On November 18, 2025, at Ignite, Microsoft said Security Copilot would be included with Microsoft 365 E5 and announced new Microsoft and partner agents. Its inclusion documentation, last updated June 19, 2026, extends the benefit to E5 and E7 customers and describes a phased automatic rollout.