Microsoft Security Copilot
AI assistant and agents for security teams, now included with M365 E5
Overview
Microsoft Security Copilot is a generative-AI assistant and agent platform for security operations across Defender, Sentinel, Entra, Intune and Purview, summarising incidents, investigating alerts and automating triage. Included with Microsoft 365 E5/E7 (400 SCUs per 1,000 licences a month); otherwise $4 per provisioned SCU per hour.
Pricing
Pricing shown for reference only. These figures reflect RECATOOLS research as of 2 Oct 2026 and may be out of date or incomplete. This is not financial or purchasing advice — always confirm the current price on the provider’s official website before making any decision.
- About $2,920 a month per SCU (our calculation)
- Standalone portal and embedded experiences
- Billed on usage above provisioned SCUs
- Chat, promptbooks and agents
- Agent Builder, APIs and MCP
- Monthly reset, no rollover
- Sentinel scenarios with E5/E7
Use cases
What you can produce with Microsoft Security Copilot
- Natural-language incident summaries and investigation
- Malware script analysis and hunting queries
- Phishing triage and other security agents
- Embedded in Defender, Sentinel, Entra, Intune and Purview
- Custom agents via Agent Builder, APIs and MCP
- Included SCUs with Microsoft 365 E5/E7
Security Copilot is a natural fit for organisations running Microsoft's security stack, and its inclusion in E5 and E7 removes the main barrier to trying it. Its agents are maturing quickly, but the value depends heavily on how much of your telemetry lives in Microsoft tools, and standalone SCU pricing adds up fast. Microsoft's own studies supply most of the performance evidence. A strong option for Microsoft-centric SOCs; others should weigh integration depth before paying for SCUs.
What we found
Microsoft Security Copilot is a generative-AI assistant and agent platform for security teams, working inside Microsoft Defender, Sentinel, Entra, Intune and Purview as well as in its own portal. Analysts ask questions in natural language to summarise incidents, investigate alerts, reverse-engineer malware scripts, write hunting queries and draft reports, and a growing set of agents — including a phishing triage agent, conditional-access and vulnerability agents, partner-built agents and no-code community agents — automate routine work. Customers can build their own agents and connect through APIs and MCP. Customer stories on Microsoft's site include St. Luke's, which says its phishing agent saves nearly 200 hours a month, and TÜV SÜD; Microsoft-commissioned studies report much faster phishing detection, figures that come from Microsoft.
Microsoft announced Security Copilot in March 2023 and made it generally available in April 2024. From November 2025 it began including the service at no extra cost for Microsoft 365 E5 and E7 customers, with a broad rollout between April and June 2026: eligible tenants receive 400 Security Compute Units a month per 1,000 paid licences, up to 10,000, pro-rated for smaller organisations, resetting monthly without rollover. Sentinel scenarios can use that allocation only with E5 or E7. Microsoft says usage beyond the allocation will be throttled, and optional paid overage offered, at a future date with 30 days' notice.
Outside that bundle, Security Copilot is bought by provisioning Security Compute Units at $4 per SCU per hour, with a minimum of one; at roughly 730 hours a month, one SCU works out to about $2,920, our calculation. Customers can set an overage limit, with extra usage billed at $6 per SCU. Sentinel data-lake, Logic Apps and partner-agent licences are charged separately.
PeerSpot reviewers rate it 8.2 out of 10 from 21 reviews. Security Copilot suits organisations already invested in Microsoft's security stack, especially E5 customers who now receive it included.
Compiled by RECATOOLS from public sources: vendor documentation and pricing, code repositories and published reporting.
Frequently asked questions
About this listing
This entry was compiled from publicly available data including Microsoft Security Copilot's official website, press releases, documentation, and reputable third-party publications. RECATOOLS is not affiliated with Microsoft Security Copilot unless explicitly stated.
Third-party AI tools update their pricing, features, availability, and policies frequently. Information here may be outdated by the time you read this — we make reasonable efforts to keep listings current, but cannot guarantee absolute accuracy.
For the latest details, please refer to Microsoft Security Copilot directly →
Spotted something out of date? Suggest an update →
Alternatives to Microsoft Security Copilot
More in Security & Safety
