What Microsoft Security Copilot does
Microsoft Security Copilot is a generative security assistant embedded across Defender, Entra, Intune, and Purview and available in a standalone investigation workspace.
Microsoft Security Copilot provides one conversational and agentic layer across Microsoft's security ecosystem. Analysts can summarize incidents, interpret scripts, create or explain queries, investigate identities and devices, generate reports, and use embedded assistance inside Defender, Entra, Intune, and Purview. The standalone experience can orchestrate plugins and promptbooks across sources. Its main operational advantage is context: a responder can move from alert to related identity, endpoint, email, data, or device evidence without manually translating every product's query language.
Pricing is capacity-based. A minimum of one provisioned Security Compute Unit is required for standalone purchased capacity, estimated at $4 per SCU each provisioned hour and billed monthly. Overage capacity is estimated at $6 per SCU used up to an administrator-set hourly limit. Eligible Microsoft 365 E5 and E7 customers receive a phased benefit of 400 SCUs monthly per 1,000 licenses, capped at 10,000, but an Azure subscription remains required. Actual agreement, currency, tax, workload mix, and embedded entitlements can change cost, so teams should pilot and monitor usage dashboards.
Security Copilot cannot make incomplete telemetry complete or turn an ambiguous alert into certainty. It may summarize the wrong evidence, generate an unsafe script, omit a related incident, or reinforce a false positive. On-behalf-of access means a broadly privileged analyst can expose broad security data through prompts, so Entra roles, Copilot roles, plugins, sharing, retention, and export controls need review. Begin with read-only investigations, compare answers with raw events, require peer approval for containment or configuration changes, protect secrets in prompts, and monitor both SCU consumption and analyst overrides.
How Microsoft Security Copilot works
An authenticated analyst asks a question or invokes an embedded feature in a Microsoft security product. Security Copilot uses on-behalf-of authentication and the user's Entra and Azure permissions to retrieve allowed signals through active plugins, then generates summaries, queries, scripts, explanations, or response guidance. Security Compute Units meter the workload, while the analyst validates evidence and authorizes consequential action.
Authenticate within existing permissions
Security Copilot uses Entra identity, separate Copilot roles, Azure RBAC, and on-behalf-of plugin access. Analysts can retrieve only the product data their underlying permissions allow, making role design foundational.
Correlate security context
A prompt or embedded workflow gathers permitted incidents, identities, endpoints, email, devices, or data signals and generates summaries, queries, scripts, or explanations. Analysts open raw evidence to confirm every link.
Separate fact from recommendation
The responder tests assumptions, false positives, missing telemetry, scope, and business context before accepting a verdict or script. Peer review protects consequential changes.
Authorize response and monitor capacity
Approved actions run through the relevant Microsoft product under existing controls. Teams preserve evidence and rollback, audit prompts and changes, and track provisioned and overage SCUs.
How to set up Microsoft Security Copilot
Define the permitted SOC use cases
Choose incident types, teams, data sources, plugins, promptbooks, scripts, and actions; classify which work is read-only, approval-required, prohibited, or emergency-only.
Model capacity and licensing
Confirm Azure, Entra, E5/E7 included capacity, provisioned and overage SCUs, regional price, workloads, usage limits, chargeback, and alerting before purchase.
Configure least-privilege access
Separate Security Copilot roles from Entra product roles, use groups, limit plugins and sharing, and test each persona against sensitive incidents and data.
Benchmark investigations
Run known true positives, false positives, incomplete telemetry, benign admin activity, adversarial prompts, scripts, and cross-product incidents; inspect every source.
Stage response automation
Keep early use read-only, require peer approval and rollback for actions, log prompts and corrections, monitor SCUs and false positives, and review permissions regularly.
Microsoft Security Copilot FAQs
How much does Microsoft Security Copilot cost?
Microsoft estimates $4 per provisioned SCU per hour and $6 per overage SCU used. One provisioned SCU is the minimum; agreement and region can change pricing.
Is Security Copilot included with Microsoft 365 E5?
Eligible E5 and E7 customers are receiving phased included capacity of 400 SCUs monthly per 1,000 licenses, up to 10,000. Confirm tenant activation and terms.
Does Security Copilot bypass existing permissions?
No. It uses on-behalf-of authentication and underlying Entra and Azure RBAC for plugin data, plus separate Copilot roles for platform functions.
Can it contain an endpoint automatically?
Supported products and agents can recommend or execute configured actions, but organizations should begin read-only and require accountable approval for containment or destructive changes.
Are its incident summaries always accurate?
No. Missing telemetry, role visibility, model error, and false positives can produce incomplete or wrong summaries. Analysts must inspect raw evidence and corroborate conclusions.
Listing reviewed 2026-07-15. Product details and pricing can change; verify important terms on the provider's website.
Related Productivity AI tools
Related AI guides
Reviews
Tell the community what you made, what worked, and what you wish you knew before starting.