What is Microsoft Security Copilot?
A generative AI security assistant from Microsoft: you ask questions in plain language and it answers using the organization's own data from connected Microsoft security products, plugins and agents. Microsoft says it runs as a standalone web experience and embedded inside products such as Defender XDR, Sentinel, Entra, Intune and Purview.
Who it's for
Security and IT teams, such as incident responders and administrators, that already use Microsoft security products and want AI help with tasks like incident triage, threat hunting and posture management. Microsoft's documentation applies to commercial clouds only and says the product is not designed for US government clouds.
Pros & cons
Strengths
- Microsoft lists eight products that embed Security Copilot: Azure Firewall, Defender for Cloud, Defender Threat Intelligence, Defender XDR, Entra, Intune, Purview and Sentinel.
- Microsoft lists use cases including alert triage with step-by-step response guidance, KQL query building, suspicious script analysis, security posture management and stakeholder reports.
- Microsoft says plugins connect it to Microsoft and supported non-Microsoft services (its overview names ServiceNow and Jamf), plus the public web and custom plugins you build.
- Microsoft says agents pair data and code with an AI language model to automate repetitive tasks, and that no special training or extra license is required to use them.
- Microsoft says prompts and responses are encrypted in transit and at rest, and that by default no human users have access to the database.
- Microsoft says customer data is not used to train Azure OpenAI foundation models and is not shared with OpenAI.
Limitations
- Billing is usage-based in security compute units (SCUs): provisioned capacity is $4 per SCU per hour (minimum 1 SCU, billed monthly) and overage is $6 per SCU. Microsoft says agents consume SCUs the same as other features.
- Microsoft's pricing page lists no free plan and no trial specific to this product; the only free item mentioned is the free Azure subscription its capacity calculator requires.
- The Microsoft 365 E5 inclusion is 400 SCUs a month per 1,000 user licenses, capped at 10,000 SCUs a month; Microsoft says E5 customers already using the product as of November 18, 2025 can access it now, and other E5 and E7 customers are activated in a phased rollout.
- Data sharing with Microsoft is on by default and owners can turn it off; Microsoft's privacy page says both that shared data is deleted within 30 days of opting out and that previously shared data is kept for not more than 180 days. Its data FAQ says session deletion sets a 30-day deletion window and logs are kept up to 90 days.
- Products that integrate as plugins must be purchased separately, and which plugins you can use depends on the services your organization uses.
Plans and pricing
- Provisioned SCUs: $4 per SCU per hour. Reserved capacity for regular workloads, minimum 1 SCU, priced per hour and billed monthly.
- Overage SCUs: $6 per SCU. Billed on actual use for spikes, up to an optional hourly limit you set.
- Included with Microsoft 365 E5 / E7: Included. 400 SCUs a month per 1,000 user licenses, up to 10,000 a month; agents in Defender, Entra, Intune and Purview at no added cost with E5; phased rollout.
Prices were read from Microsoft's US pricing page and are USD estimates, not quotes; they can vary by agreement type, purchase date, exchange rate and taxes. The page lists no named tiers, no monthly or per-seat price, and no free plan or trial. Confirm on the live pricing page.
Details checked October 2026 against the vendor's own pages. Prices and limits change, so confirm before you buy. Official pricing page ↗
Sources
This profile was compiled from these public pages. We have not run hands-on tests.
- microsoft.com/en-us/security/pricing/microsoft-security-copilot
- learn.microsoft.com/en-us/copilot/security/microsoft-security-copilot
- learn.microsoft.com/en-us/copilot/security/experiences-security-cop...
- learn.microsoft.com/security-copilot/agents-overview
- learn.microsoft.com/en-us/copilot/security/plugin-overview
- learn.microsoft.com/en-us/copilot/security/faq-data-compliance
- learn.microsoft.com/en-us/copilot/security/privacy-data-security
Microsoft Security Copilot — at a glance
A generative AI security assistant from Microsoft: you ask questions in plain language and it answers using the organization's own data from connected Microsoft security products, plugins and agents. Microsoft says it runs as a standalone web experience and embedded inside products such as Defender XDR, Sentinel, Entra, Intune and Purview.
Try Microsoft Security Copilot →