IntelligentHQ
IntelligentHQ
Skip to content
Cloud application Security operations

Microsoft Security Copilot

Microsoft Security Copilot is a generative AI service for security and IT teams. It summarizes incidents, writes KQL and runs agents in its own portal and inside Defender, Entra, Intune, Purview and Sentinel. Usage is measured in Security Compute Units; Microsoft 365 E5 and E7 include a monthly allocation.12

Also known as Security Copilot, Copilot in Intune, Copilot in Microsoft Purview

Intended for
SOC analysts and incident responders, Identity and access administrators, Data security and compliance teams, Endpoint and IT administrators, Developers building security agents
Runs on
SaaS in Microsoft commercial clouds, Standalone portal, Embedded in Microsoft Defender, Entra, Intune and Purview admin centers, Works with Microsoft Sentinel
Official Microsoft product page (opens in a new tab) Official documentation (opens in a new tab)

At a glance

What is it?
Security Copilot combines a language model with Microsoft and third-party plugins that pull context from security products, threat intelligence and your organization's data. It has a standalone portal and embedded experiences in the Microsoft Defender, Entra, Intune and Purview admin centers, and it works with Microsoft Sentinel. Agents are task-specific automations, for example phishing triage or Conditional Access optimization, that run on a schedule or when an event occurs. Capacity is measured in Security Compute Units (SCUs). Microsoft's documentation says it is meant for commercial clouds and is not designed for US government clouds such as GCC, GCC High, DoD or Azure Government.13
What does it do?
It turns incidents and alerts into summaries with step-by-step response guidance, translates questions into KQL hunting queries, explains suspicious scripts, summarizes policies and checks them for conflicts, and drafts reports for different audiences. Before calling the model it grounds the prompt with plugin data, and afterwards it adds more context from plugins. Agents from Microsoft and partners, and custom agents built with Agent Builder, APIs or MCP, take over high-volume tasks. Microsoft-built agents can run under their own Microsoft Entra Agent ID identity.123
Who needs it?
Security operations centers with more alerts than analysts, identity teams that maintain many Conditional Access policies, data security teams triaging DLP and insider risk alerts, and endpoint teams handling change approvals and vulnerability remediation. Microsoft 365 E5 and E7 customers are the obvious first users, because capacity comes with their license.2
What does it need?24
  • Microsoft 365 E5 or E7 (capacity is provisioned automatically for eligible tenants) or an Azure subscription to provision SCUs
  • A commercial cloud tenant, not GCC, GCC High, DoD or Azure Government
  • Licenses for the products each agent works on, for example Defender for Office 365 Plan 2 for email alert triage or Microsoft Entra ID P1 for Conditional Access optimization
  • Admin roles to set up agents, such as Security Administrator
What it is not
Security Copilot is not a SIEM or XDR: it reasons over data that products such as Defender, Sentinel, Entra, Intune and Purview already hold. It is not the general Microsoft Copilot work assistant. Agents do not switch themselves on: an administrator must set each one up and give it an identity and permissions. It is not available for US government clouds. Its output still needs review, which is why agents show their reasoning and accept analyst feedback.2

Availability and licensing. Generally available in commercial clouds; not designed for GCC, GCC High, DoD or Azure Government. Included for Microsoft 365 E5 and E7 customers (rollout started 18 Nov 2025): 400 SCUs per month per 1,000 paid user licenses, up to 10,000 per month. Checked 26 Oct 2026, the pricing page example uses $4 per provisioned SCU per hour and $6 per overage SCU. Microsoft says E5 and E7 usage above the allocation will be throttled at a future date, with pay-as-you-go at $6 per SCU and 30 days of advance notice.256

The problem it solves

Security teams face more alerts, policies and threat reports than they can read. Much of the work repeats: triaging user-reported phishing, writing hunting queries, checking whether a new Conditional Access policy conflicts with existing ones, or deciding which vulnerable devices to fix first.

Security Copilot applies a language model, grounded in data from Microsoft security products and threat intelligence, to draft answers and to run agents that do this work, while analysts review verdicts and stay in control of actions.3

How it works

Microsoft describes a loop of four steps:

  1. A prompt arrives from the standalone portal or an embedded experience.
  2. Security Copilot grounds the prompt with plugins (Microsoft security products, third-party services such as ServiceNow, and threat intelligence) and sends it to the language model.
  3. It post-processes the answer, again using plugins for context.
  4. The user reviews the response.

Agents add a trigger (a schedule or an event), permissions and an identity: either a dedicated Microsoft Entra agent identity, currently only for Microsoft-built agents, or the account of the user who set the agent up. Prompts, promptbooks and agent runs consume SCUs, either from capacity provisioned by the hour or from the monthly Microsoft 365 E5 and E7 allocation. Microsoft and partner agents can be found and bought in Microsoft Security Store.17

Microsoft Security Copilot architecture: components by layer and how they connectCopilot & businessappsAgents & automationAI models & platformDeveloper toolsSecurity, identity &governanceCloud & hybridinfrastructurePrograms & resourcesSecurity Copilot portal: Chat, promptbooks, agent library and usage dashboardSecurity Copilot portalEmbedded experiences in Defender, Entra, Intune and Purview: AI help and agents inside each admin centerEmbedded experiences inDefender, Entra, Intune and…Agents (Microsoft, partner, custom): Run on triggers with defined permissionsAgents (Microsoft, partner,custom)Grounding and orchestration: Pre-processes and post-processes prompts with plugin dataGrounding and orchestrationLanguage model: Generates the responseLanguage modelPlugins and connectors: Bring data from Microsoft products, third-party tools and threat intelligencePlugins and connectorsMicrosoft Entra Agent ID: Dedicated identity for Microsoft-built agentsMicrosoft Entra Agent IDSecurity Compute Units: Capacity consumed by prompts and agent runsSecurity Compute UnitsMicrosoft Security Store: Where Microsoft and partner agents are found and boughtMicrosoft Security Store
Diagram as a list

  1. Copilot & business apps

    • Security Copilot portalChat, promptbooks, agent library and usage dashboardConnects to Grounding and orchestration
    • Embedded experiences in Defender, Entra, Intune and PurviewAI help and agents inside each admin centerConnects to Grounding and orchestration

  2. Agents & automation

    • Agents (Microsoft, partner, custom)Run on triggers with defined permissions

  3. AI models & platform

    • Grounding and orchestrationPre-processes and post-processes prompts with plugin data
    • Language modelGenerates the response

  4. Developer tools

    • Plugins and connectorsBring data from Microsoft products, third-party tools and threat intelligence

  5. Security, identity & governance

    • Microsoft Entra Agent IDDedicated identity for Microsoft-built agents

  6. Cloud & hybrid infrastructure

    • Security Compute UnitsCapacity consumed by prompts and agent runs

  7. Programs & resources

    • Microsoft Security StoreWhere Microsoft and partner agents are found and boughtConnects to Agents (Microsoft, partner, custom)
Components and connections as documented by Microsoft.1

Capabilities

  • Natural-language investigation1

    Incident summaries with response guidance, KQL generation, analysis of suspicious scripts, policy summaries and stakeholder reports.

    Why it matters: Lets less experienced team members do technical tasks and saves senior analysts time.

    Limits: Answers depend on the plugin data the user can reach; review before acting.

  • Embedded experiences2

    Security Copilot appears inside Microsoft Defender, Entra, Intune and Purview, and works with Microsoft Sentinel.

    Why it matters: AI help without leaving the admin center where the work happens.

    Limits: What is available depends on which products the organization licenses.

  • Microsoft-built agents4689

    Agents include the Phishing Triage Agent in Defender, the Conditional Access Optimization Agent and Identity Risk Management Agent (preview) in Entra, Change Review, Device Offboarding, Policy Configuration and Vulnerability Remediation agents in Intune, and DLP and insider risk triage agents in Purview (preview).

    Why it matters: Automates high-volume work such as alert triage, access policy review and patch prioritization.

    Limits: Each agent must be set up, many are in preview, and every run consumes SCUs.

  • Custom and partner agents27

    Agent Builder and APIs for custom agents and promptbooks, integrations through MCP and Graph APIs, and partner agents through Security Store.

    Why it matters: Fits agents to an organization's own workflows and tools.

    Limits: Partner agents may need a separate partner license; SCU costs for partner agents are included for E5 and E7 only until further notice.

  • Plugins and connectors1

    Plugins bring events, alerts, incidents and policies from Microsoft and supported third-party products such as ServiceNow and Jamf, and search Microsoft threat intelligence.

    Why it matters: More context produces more specific answers.

    Limits: Each plugin needs its own permissions and setup.

  • Capacity model2

    Usage is measured in Security Compute Units: provisioned per hour, or for Microsoft 365 E5 and E7, 400 SCUs per month for every 1,000 paid user licenses up to 10,000 SCUs per month.

    Why it matters: Predictable included capacity for E5 and E7 customers.

    Limits: Included SCUs reset monthly without rollover; Microsoft says usage above the allocation will later be throttled, with optional pay-as-you-go at $6 per SCU.

Practical use cases

SOC analysts lose hours every day on user-reported phishing.
Approach
Set up the Phishing Triage Agent in Defender so it classifies submissions and explains each verdict.
Role of Microsoft Security Copilot
Security Copilot runs the agent and records its reasoning for analyst review.
Data, infrastructure and skills
Security Copilot capacity and Defender for Office 365 Plan 2.
Type of benefit
Analyst time saved
Caveats
Analysts should keep reviewing verdicts and giving feedback; broader alert types are in preview.
First step
Set up the agent in the Defender portal with a dedicated agent identity.
Conditional Access policies have grown over years and nobody knows where the gaps and overlaps are.
Approach
Turn on the Conditional Access Optimization Agent in the Entra admin center; it reviews policies every 24 hours against Microsoft best practices.
Role of Microsoft Security Copilot
Security Copilot powers the agent and its recommendations.
Data, infrastructure and skills
Microsoft Entra ID P1, Security Copilot capacity, Security Administrator to configure and Conditional Access Administrator to use.
Type of benefit
Stronger access control
Caveats
Recommendations still need review before they are applied.
First step
Open Agents in the Entra admin center and select View details for the agent.
An E5 customer wants to know whether its included capacity covers planned agent use.
Approach
Track SCU consumption in the usage dashboard while piloting a few agents.
Role of Microsoft Security Copilot
Security Copilot meters each prompt and agent run against the monthly allocation.
Data, infrastructure and skills
Microsoft 365 E5 or E7 inclusion enabled for the tenant.
Type of benefit
Cost control
Caveats
Allocations reset monthly and do not roll over.
First step
Open the usage dashboard in the standalone portal after the first week of use.

Who uses it

Works with

Optional integration

  • Microsoft Defender XDREmbedded in the Defender portal, with agents for alert triage, threat intelligence and hunting.
  • Microsoft SentinelWorks with Sentinel data; E5 and E7 SCUs can be used for Sentinel scenarios.
  • Microsoft EntraEmbedded in the Entra admin center; Microsoft-built agents can use Entra Agent ID identities.
  • Microsoft IntuneCopilot in Intune is powered by Security Copilot.
  • Microsoft PurviewEmbedded in Purview with DLP and insider risk triage agents (preview).

Complementary tools

  • Microsoft 365 E7Security Copilot capacity is included with Microsoft 365 E5 and E7.

Optional integration for

Relationship labels follow Microsoft's documentation. "Alternative approaches" does not mean one is better: each profile says when it fits.

Getting started

  1. Check eligibility

    Eligible Microsoft 365 E5 and E7 tenants receive Security Copilot through automatic provisioning and are notified in the Microsoft 365 admin center; other customers provision SCUs with an Azure subscription.

    Check: Banners appear in Defender, Purview, Entra or Intune, or a capacity is listed in the standalone portal.

  2. Review owner settings

    Confirm the data storage geography, GPU processing location, data sharing (off by default) and access to Microsoft 365 data (on by default).

    Check: Settings match your data protection policy.

  3. Set up one agent

    Open Agents in the relevant portal, pick an agent, give it an identity and permissions, and set its trigger.

    Check: The agent is listed under Agents in use and shows its runs.

  4. Track usage

    Watch SCU use in the usage dashboard; E5 and E7 allocations reset each month.

    Check: Monthly usage stays within the allocation.

Official resources

Deciding whether you need it?

Three free tools apply Microsoft's own published guidance to your situation, and say when Microsoft Security Copilot or any new technology is not needed.

Sources

Each statement above links to the source it comes from. Labels say who reported it.

  1. What is Microsoft Security Copilot? (opens in a new tab) Microsoft · Vendor-reported
  2. Learn about Security Copilot for Microsoft 365 E5 and E7 customers (opens in a new tab) Microsoft · Vendor-reported
  3. Microsoft Security Copilot agents overview (Microsoft Learn) (opens in a new tab) Microsoft · Vendor-reported
  4. Microsoft Entra agents (Microsoft Learn) (opens in a new tab) Microsoft · Vendor-reported
  5. Microsoft Security Copilot pricing page (opens in a new tab) Microsoft · Vendor-reported
  6. Microsoft Security Copilot product page (opens in a new tab) Microsoft · Vendor-reported · link checked 27 Oct 2026
  7. Discover agents in Microsoft Security Copilot (Microsoft Learn) (opens in a new tab) Microsoft · Vendor-reported
  8. Security Copilot agents in Intune (Microsoft Learn) (opens in a new tab) Microsoft · Vendor-reported
  9. Microsoft Security Copilot agents in Microsoft Purview (Microsoft Learn) (opens in a new tab) Microsoft · Vendor-reported
  10. What is Microsoft Intune? (opens in a new tab) Microsoft · Vendor-reported

Fill out the form below to request your copy.

Name(Required)