Security Copilot now included for MS365 E5 customers

Security Copilot agents will now be directly built into the flow of work for security teams using Microsoft Defender, Microsoft Entra, Microsoft Intune, and Microsoft Purview.

A dozen new agents have been introduced across these products, aiming to bring agentic defense across workflows, enabling autonomous and proactive protection.

Rollout has begun for existing Security Copilot customers with Microsoft 365 E5 and will continue in the upcoming months for all Microsoft 365 E5 customers.

All chat, promptbook, and agentic scenarios across Microsoft Entra, Microsoft Intune, Microsoft Purview, Microsoft Defender, and the standalone Security Copilot portal are included.

Additionally, customers with Microsoft 365 E5 who also use Microsoft Sentinel can apply their included Security Compute Unit (SCU) - a unit measure of the compute power to run Security Copilot workloads - allocation to run Security Copilot scenarios in Microsoft Sentinel.

Tools such as Agent Builder and APIs for creating custom agents, promptbooks, and integrations via MCP and Graph APIs are also included.

Any capabilities beyond those that are part of the core Security Copilot value requires additional payment.

This includes Microsoft Sentinel data lake compute or storage costs; non-agentic Data Security Investigations experience in Microsoft Purview; charges for Azure Logic Apps for usage with Security Copilot; and partner-built agent licensing paid through Security Store.

Some agents may also require prerequisites that involve products outside of Microsoft 365 E5 which are not covered.

No Azure setup or consent flows are required to configure Security Copilot and customers will see in-product banners and guided onboarding to help them get started. No manual provisioning of SCUs is needed.

If an MSP is a Microsoft 365 E5 customer using Security Copilot today, whether internally or to manage the security of a customer, they no longer need to do separate billing for Security Copilot and can enjoy continued access to all agentic and chat experiences.

Customers with Microsoft 365 E5 will have 400 Security Compute Units (SCU) each month for every 1,000 paid user license, up to 10,000 SCUs each month at no additional cost.

This amount scales by user license count, including for customers with fewer than 1,000 user licenses. This included capacity is expected to support typical scenarios as mentioned.