Generative AI security assistant with agents embedded across Microsoft Defender, Entra, Intune, and Purview to help teams detect, investigate, and respond faster.
Microsoft Security Copilot is a generative AI-powered security and IT assistant from Microsoft, available as a standalone experience or embedded within Microsoft Security products. It combines a specialized language model with security-specific skills informed by Microsoft threat intelligence, summarizing vast data signals into key insights and providing AI-driven guidance across identities, devices, data, clouds, and apps. Ready-to-use agents help automate tasks such as phishing triage, vulnerability remediation, and alert triage, while promptbooks and partner plugins extend insights. It is intended for security and IT teams that need to investigate incidents and respond in minutes rather than hours. Access is provisioned through security compute units (SCUs) purchased in the product or Azure portal, and Security Copilot is also being made available to Microsoft 365 E5 and E7 customers.
How to use Microsoft Security Copilot
1
Provision security compute units
Purchase the desired number of SCUs within the Security Copilot product or the Azure portal to power Security Copilot workloads.
2
Choose provisioned and overage capacity
Allocate provisioned SCUs for routine workloads (minimum of 1 provisioned SCU) and set an overage limit to cover unexpected demand.
3
Use agents in Microsoft Security products
Interact with Security Copilot agents from within Microsoft Defender, Entra, Intune, Microsoft Purview, and Security Copilot.
4
Estimate and monitor usage
Estimate SCU needs with the capacity calculator (Azure account required) and track consumption with the in-product usage dashboard.
Microsoft Security Copilot Features
Generative AI-powered security and IT assistant available standalone or embedded in Microsoft Security products
Summarizes vast data signals into key insights across identities, devices, data, clouds, and apps
Ready-to-use agents for tasks such as phishing triage, vulnerability remediation, and alert triage
Promptbooks and partner plugins that extend customer insights
Integrations with Microsoft Defender XDR, Sentinel, Intune, Entra, Purview, Defender for Cloud, and Azure security tools
In-product usage dashboard for monitoring SCU consumption
Microsoft Security Copilot Use Cases
Security teams investigating and responding to incidents faster
Automating high-volume security tasks with agents
Triaging phishing alerts and vulnerabilities
Providing step-by-step guidance to strengthen team expertise
Estimating and managing security compute capacity
Microsoft Security Copilot FAQs
It delivers agentic automation and AI-driven insights across security and IT, helping organizations protect, detect, and respond at the speed and scale of AI.
Yes, Security Copilot is generally available for use by security and IT teams.
Provision compute capacity by purchasing security compute units (SCUs) within the Security Copilot product or the Azure portal. Security Copilot will also be included in Microsoft 365 E5.
An SCU is a unit measure of the compute power to run Security Copilot workloads within the standalone and embedded experiences.
Provisioned SCUs are billed at $4 per SCU per hour and overage SCUs at $6 per SCU per hour. Your monthly bill is based on the number of SCUs provisioned every hour for the month plus any additional overage capacity used.
Yes. It integrates with products including Microsoft Defender XDR, Microsoft Sentinel, Microsoft Intune, Microsoft Entra, Microsoft Purview, Microsoft Defender for Cloud, and Azure security tools such as Azure WAF and Azure Firewall.
Yes. It integrates with partner products to provide plugins and promptbooks that extend customer insights, and includes agents built by partners.
Eligible Microsoft 365 E5 and E7 customers receive 400 SCUs per month for every 1,000 user licenses, up to 10,000 SCUs per month, through a phased roll-out.
Prices are estimates only and are not intended as actual price quotes; actual pricing may vary by agreement, date of purchase, currency exchange rate, and taxes. A minimum of 1 provisioned SCU is required. Eligible Microsoft 365 E5 and E7 customers receive 400 SCUs per month for every 1,000 user licenses, up to 10,000 SCUs per month, through a phased roll-out.
Provisioned SCU
$4USD / per Security Compute Unit per hour
Provisioned capacity for expected, regular Security Copilot workloads, with a minimum of 1 provisioned SCU required.
Billed per Security Compute Unit per hour
Intended for routine workloads
Minimum of 1 provisioned SCU required
Monthly bill based on SCUs provisioned every hour for the month
Overage SCU
$6USD / per Security Compute Unit per hour
Flexible overage capacity for unexpected or seasonal demand, billed only for what is used up to the selected overage limit.
Billed per Security Compute Unit per hour
For unexpected or seasonal capacity spikes
Only pay for what you use, up to your selected overage limit