What Security Copilot is
Security Copilot is a generative AI assistant for security operations and IT: it investigates incidents, writes and explains KQL queries, analyses suspicious scripts, summarises threats using Microsoft's global threat intelligence, and automates repetitive work through promptbooks and autonomous agents. It runs as a standalone portal and embedded inside the tools analysts already use — Defender XDR, Microsoft Sentinel, Intune, Purview, Entra and Defender for Cloud. The intended users are SOC analysts, IT admins, identity and data security admins — not end users.
How SCU pricing works
Security Copilot is priced per capacity, not per user. The unit is the Security Compute Unit (SCU): provisioned SCUs run US$4 per SCU per hour, billed monthly, with a minimum of one provisioned SCU per tenant; overage SCUs cover spikes on demand at US$6 per SCU and bill only when used, up to a cap you set (checked August 2026, USD). Every prompt, promptbook and agent run consumes SCUs based on complexity, so costs track usage intensity rather than headcount. Start with the SCU capacity calculator, provision small, and watch the in-product dashboard — consumption varies widely between teams.
The E5/E7 included capacity
The buying decision changed in 2026: eligible Microsoft 365 E5 and E7 customers now receive 400 SCUs per month for every 1,000 user licences, up to 10,000 SCUs per month, as included capacity (checked August 2026). Microsoft expects that grant to cover typical scenarios. For Australian E5 tenants this turns Security Copilot from a pure-consumption line item into something you may already be entitled to — check your entitlement before provisioning paid SCUs, and treat paid capacity as top-up for heavy automation rather than the starting point.
Where it fits versus Microsoft 365 Copilot
They share a brand and nothing else. Microsoft 365 Copilot is a per-user productivity licence that works inside Word, Excel, Outlook and Teams for everyone. Security Copilot is capacity-priced tooling for the security and IT team — a handful of specialists drawing on a shared SCU pool. Different buyer, different budget line, different rollout: M365 Copilot is an adoption program across the workforce; Security Copilot is a SOC tooling decision that lives next to your Sentinel and Defender XDR investment.