In short: Microsoft Security Copilot is a generative AI assistant and agent platform for security and IT teams, available in its own portal and embedded in Defender, Entra, Intune and Purview. Microsoft 365 E5 and E7 customers receive a monthly allocation of Security Compute Units at no extra cost; other organisations buy capacity separately.
What Security Copilot is
Security Copilot uses large language models, grounded in your Microsoft security data and Microsoft's threat intelligence, to help analysts and administrators work faster. You can use it in two ways:
- The standalone portal, for open-ended questions, promptbooks and investigations that span several products
- Embedded experiences inside the Microsoft Defender, Entra, Intune and Purview portals, where it summarises incidents, explains scripts and alerts, drafts queries and suggests next steps in context
Its usage is measured in Security Compute Units (SCUs), a unit of the compute needed to run its AI workloads. It can only see data from products you license and have connected, and it works within the permissions of the person using it.
Agents in Defender, Entra, Intune and Purview
At Ignite in November 2025 Microsoft announced a dozen new Security Copilot agents built into the flow of work in Defender, Entra, Intune and Purview, alongside earlier agents such as phishing triage. Each agent handles a specific, repetitive task; an administrator chooses to deploy it, gives it an identity and permissions, and reviews what it does. Examples from Microsoft's documentation:
| Product | Example agent | What it does | Licence it relies on |
|---|---|---|---|
| Microsoft Defender | Phishing Triage Agent (being extended in preview as the Security Alert Triage Agent) | Classifies user-reported phishing and other alerts, separating real threats from false alarms and explaining its verdict | Defender for Office 365 Plan 2 for email alerts |
| Microsoft Defender | Threat Intelligence Briefing Agent | Produces regular threat briefings tailored to your organisation | Security Copilot only |
| Microsoft Entra | Conditional Access Optimization Agent | Checks conditional access policies for gaps, overlaps and misconfigurations and recommends fixes | Entra ID P1 |
| Microsoft Purview | Triage Agent in Insider Risk Management; Alert Triage Agent in DLP (preview) | Sorts insider risk and data loss prevention alerts by risk so analysts see the important ones first | The relevant Purview licence |
| Microsoft Intune | Vulnerability Remediation Agent; Device Offboarding Agent; Policy Configuration Agent | Prioritises device vulnerabilities using Defender data, finds stale devices and turns plain-language requirements into policy settings | Intune plus Defender data |
Agents are not switched on automatically; your organisation sets them up, and they consume SCUs when they run. Availability and preview status vary by agent and change often. You can also build custom agents and add partner-built agents from the Microsoft Security Store.
What Microsoft 365 E5 and E7 include
Microsoft now includes Security Copilot for all Microsoft 365 E5 and Microsoft 365 E7 customers. The rollout began on 18 November 2025 and is being phased in for eligible tenants, which are provisioned automatically with no Azure set-up.
- Allocation: 400 SCUs a month for every 1,000 paid user licences, up to 10,000 SCUs a month, scaled down proportionally for smaller tenants (Microsoft's own example: 400 licences gives 160 SCUs a month)
- No rollover: the allocation resets monthly and unused SCUs do not carry forward
- Coverage: chat, promptbooks and agents across Defender, Entra, Intune, Purview and the standalone portal, developer tools for custom agents, plus Sentinel scenarios for E5 and E7 customers who also use Sentinel
- Partner agents: SCU use by partner-built agents is included for now, although the partner may charge for its own licence
- Not covered: Microsoft Sentinel data lake compute and storage, the non-agentic Data Security Investigations experience in Purview, Azure Logic Apps charges, partner agent licences bought through the Security Store, and agents whose prerequisites sit outside E5 and E7
- Sentinel-only customers: organisations that use Sentinel but do not hold E5 or E7 are not eligible
Microsoft has said usage beyond the allocation will be throttled at a future date, with an option to pay for extra capacity, and that customers will get 30 days' notice. Existing customers with provisioned capacity are advised not to delete it. Ask us for a quote rather than relying on list prices.
The capacity model for everyone else
Organisations without Microsoft 365 E5 or E7, including Business Premium and E3 tenants and those that add the Microsoft Defender Suite, can still use Security Copilot under Microsoft's standard capacity model. In that model you provision a number of SCUs per hour in Azure and are billed for that provisioned capacity, with an option for overage when demand spikes.
That makes sizing important. A small team that uses Security Copilot occasionally can waste provisioned capacity, while a busy security operations team may need more than expected. We help you estimate realistic usage before you commit, and check whether the cost is better spent elsewhere, for example on a managed detection and response service.
Readiness and data handling
Before you switch it on, or as soon as it is auto-provisioned, review the settings Microsoft preselects:
- Data location: the geography where customer data such as prompts and responses is stored, and where GPU processing takes place
- Data sharing: whether customer data is shared with Microsoft for product improvement (off by default for auto-provisioned tenants)
- Access to Microsoft 365 data: on by default; turning it off limits what Security Copilot can do with Purview and other Microsoft 365 products
- Roles: which existing security roles inherit Security Copilot owner and contributor access
- Plugins and agents: which are enabled, who can deploy agents and what each agent is allowed to change
Security Copilot copies and processes relevant data to answer prompts. For UK GDPR purposes, record it in your processing records and check its settings against your data protection policies. Its answers are only as good as the underlying configuration, so a well-set-up Defender, Entra and Purview estate comes first. Our AI security page covers the wider question of staff use of generative AI.
How we help
We check whether your tenant is eligible for the E5 or E7 allocation, review the auto-provisioned settings, choose which agents to deploy first and set up monitoring of SCU usage. For other tenants we size the capacity model and compare it with the alternatives.
Contact us to discuss Security Copilot readiness.
How Forever Systems helps with cloud security
We are an independent UK IT and cyber security provider. We supply and support a wide range of security platforms, so we recommend what fits your organisation rather than one vendor's answer to everything.
- Assess first: we review what you already own, especially your Microsoft 365 licences, before suggesting anything new
- Vendor-aware advice across secure access, email, identity, data protection, endpoint, MDR, cloud infrastructure, browser, AI and backup, including Cisco Secure, Check Point Harmony and Sophos
- Deployment and migration from a UK team, from tenant hardening to replacing a VPN or an endpoint product
- Ongoing support: policy tuning, alert handling, renewals and regular reviews
- People and certification too: security awareness training and Cyber Essentials
We work with businesses, schools, charities and public sector organisations.
Want an independent view of your cloud security?
Tell Forever Systems what you need and we will come back to you by email with options, not a hard sell.
Contact usFrequently asked questions
Is Security Copilot included in Microsoft 365 E5?
Yes. Microsoft includes Security Copilot for Microsoft 365 E5 and E7 customers, with a monthly allocation of 400 Security Compute Units per 1,000 paid user licences, up to 10,000 a month. The rollout started in November 2025 and is phased.
Is Security Copilot included in Microsoft 365 Business Premium?
No. The inclusion applies to Microsoft 365 E5 and E7. Business Premium and E3 customers can use Security Copilot by buying capacity under Microsoft's standard model.
What is a Security Compute Unit (SCU)?
An SCU is Microsoft's unit of the compute used to run Security Copilot's AI workloads, in both the standalone portal and the embedded experiences. Prompts, summaries and agent runs consume SCUs.
Do unused Security Copilot SCUs roll over?
No. For E5 and E7 customers the SCU allocation resets every month and unused units cannot be carried forward.
Does Security Copilot replace a security analyst?
No. It speeds up triage, investigation and routine administration, and agents can handle some repetitive tasks, but people still decide what to act on. Smaller organisations without analysts often get more from a managed detection and response service.