Microsoft Security Copilot
Verified Oct 16, 2026 ActiveAgents and an assistant across Defender, Sentinel, Entra, Intune and Purview, billed in Security Compute Units
Listed on EffectHub ·
Pricing
- Pricing model
- Paid
Billed on Security Compute Units, not seats: $4 per provisioned SCU per hour (about $2,920 a month for one unit running continuously) and $6 per overage SCU, minimum one provisioned SCU; Microsoft calls these estimates, not quotes. Microsoft 365 E5 and E7 tenants receive agents at no added cost and 400 SCUs per month per 1,000 user licences, up to 10,000 SCUs.
Use tool ↗About Microsoft Security Copilot
Security Copilot is Microsoft's AI layer for security and IT teams: it summarises incidents, explains scripts, generates hunting queries and now runs agents — phishing triage, conditional-access optimisation and partner-built ones — inside Defender, Sentinel, Entra, Intune and Purview as well as a standalone portal. It is not sold per seat: you provision Security Compute Units at $4 per SCU-hour, with overage at $6 per SCU, and a minimum of one provisioned unit. Since late 2025 Microsoft 365 E5 customers get the agents at no added cost plus 400 SCUs a month per 1,000 licences, capped at 10,000. The product is generally available and only makes sense inside a Microsoft security estate.
- Platforms
- Web
- API
- Not confirmed
- Last verified
- Oct 16, 2026
Verified sources
- Pricing page FAQ example bills $4 per provisioned SCU per hour and $6 per overage SCU, requires at least 1 provisioned SCU, says prices are estimates not quotes, and states that agents come at no added cost with Microsoft 365 E5 plus 400 SCUs per month per 1,000 licences up to 10,000 (15 October 2026)microsoft.com ↗
- Product page: generally available, embedded in Defender, Intune, Entra and Purview and integrated with Sentinel, Defender for Cloud, Azure WAF and Firewall; agents include Phishing Triage and Conditional Access Optimization; E5 allowance example 4,000 seats = 1,600 SCUs/month; phased rollout for E5/E7 tenants not using it as of 18 November 2025 (15 October 2026)microsoft.com ↗
- Microsoft Learn: provisioned and overage SCUs are set in the Azure or Security Copilot portal, changes apply within 30 minutes, monthly estimate assumes capacity runs 24 hours a day, and analysts are blocked until the next hour once 100% of capacity is used (15 October 2026)learn.microsoft.com ↗
Is Microsoft Security Copilot legit?
We don’t label tools safe or unsafe. Below are the records we checked ourselves, each with the date we read it.
- Domain registered
- May 2, 1991 (35 years ago)Registry record (RDAP), registrar MarkMonitor Inc., looked up Sep 6, 2026
- TLS certificate
- Issued by Microsoft Corporation, valid until Jan 17, 2027Seen in our own connection to the site on Oct 16, 2026
- Last checked
- Oct 16, 2026The site answered
- Operated by
- Microsoft, United StatesOur research, card verified Oct 15, 2026
Pros & cons of Microsoft Security Copilot
Worth switching on if your SOC already lives in Defender, Sentinel and Entra — especially on E5, where the agents and a monthly SCU allowance now come with the licence. Outside that estate the value collapses: the assistant reasons over Microsoft signals, and the SCU meter turns a casual trial into a surprising Azure line item. Treat it as an add-on to a Microsoft security stack, not a product you evaluate on its own.
Pros
- Embedded in Defender, Sentinel, Entra, Intune and Purview rather than a separate console
- Agents for phishing triage and conditional-access review run without a prompt
- E5 and E7 licences now include the agents and 400 SCUs per 1,000 users
- Capacity can be raised or lowered in the portal, taking effect within about 30 minutes
Cons
- Hourly SCU billing is hard to forecast and runs even when nobody is prompting
- Minimum one provisioned SCU means a floor of roughly $2,900 a month for non-E5 tenants
- Usefulness is tied to Microsoft signals; third-party plugins cover far less
- No public API described on the product page
Best for
- SOCs standardised on Microsoft Defender XDR, Sentinel and Entra
- Microsoft 365 E5 tenants, who get agents and a baseline SCU allowance included
- Teams that want incident summaries and KQL hunting queries without writing them by hand
Not for
- Organisations whose telemetry lives mainly in non-Microsoft tools
- Small teams without Azure billing ownership or anyone to tune SCU provisioning
Watch out: Provisioned SCUs bill every hour of the month whether used or not, and when provisioned plus overage are exhausted analysts are locked out until the next hour — size the capacity against real sessions, not the demo.
Alternatives to Microsoft Security Copilot
Microsoft Security Copilot head-to-head
Side-by-side fact sheets against the competitors our research or their makers name — pricing, platforms, API and both verdicts on one page.