Microsoft Security Copilot in 2026: E5/E7 Rights, Included SCUs, and the New Economics of AI-Powered Security

For much of its early life, Microsoft Security Copilot was relatively easy to explain technically but considerably harder to explain commercially.

Organizations provisioned Security Compute Units, or SCUs, through Azure. Those units provided the compute capacity behind Security Copilot, and customers paid for that capacity whether they fully consumed it or not.

That model has changed significantly for Microsoft 365 E5 and E7 customers.

Microsoft now includes Security Copilot capacity with eligible Microsoft 365 E5 and E7 licensing. Instead of asking every organization to begin by determining how many hourly SCUs it should provision, Microsoft provides an included monthly pool of Security Compute Units based on the number of paid E5/E7 user licenses in the tenant.

For organizations already heavily invested in the Microsoft security ecosystem, this changes the conversation around Security Copilot considerably.

The question is increasingly not, “Should we purchase Security Copilot?” It becomes, “We have Security Copilot capacity through our Microsoft 365 licensing. What can we accomplish with it, and what happens if we consume more than the included amount?”

First: What Is Microsoft Security Copilot?

Microsoft Security Copilot is Microsoft’s generative AI-powered security and IT assistant. It can operate through the standalone Security Copilot experience as well as through embedded experiences across Microsoft’s security products.

The compute behind those experiences is measured in Security Compute Units.

An SCU is essentially a measure of the compute resources required to execute Security Copilot workloads. SCUs can be consumed when using the standalone portal, embedded Security Copilot functionality, Microsoft-developed agents, partner-developed agents, and other Security Copilot capabilities.

The Big Change: Security Copilot Is Included with Microsoft 365 E5 and E7

Microsoft announced at Ignite 2025 that Security Copilot agents would be integrated directly into security workflows using Microsoft Defender, Microsoft Entra, Microsoft Intune, and Microsoft Purview.

Microsoft subsequently rolled out Security Copilot inclusion for eligible Microsoft 365 E5 and E7 customers. Rollout started November 18, 2025, initially covering existing Security Copilot customers with Microsoft 365 E5. The broad auto-provisioning wave was announced in Message Center post MC1261596, which addressed Microsoft 365 E5 tenants and scheduled a phased rollout from April 20 through June 30, 2026. Microsoft’s inclusion documentation describes rollout to all eligible E5 and E7 customers as continuing in phases, so do not assume a specific tenant was enabled within that window.

If you are an E5 or E7 customer, confirm that your tenant has actually been enabled rather than assuming it. Microsoft says enabled tenants receive Microsoft 365 admin center notifications and see in-product banners in Defender, Purview, Entra, Intune, or the standalone Security Copilot portal.

Microsoft 365 E7 expands beyond E5. E7 bundles Microsoft 365 E5 with Microsoft 365 Copilot, the Microsoft Entra Suite, and Agent 365. Security Copilot is included with both Microsoft 365 E5 and E7.

But “included” needs some explanation. It does not mean unlimited Security Copilot compute. Instead, Microsoft includes an SCU allowance.

How Many SCUs Do E5 and E7 Customers Receive?

This is the number administrators, architects, and licensing teams need to remember:

Organizations do not need 1,000 licenses before receiving the benefit. The entitlement scales with the number of eligible licenses. Microsoft specifically gives examples of 400 licenses receiving 160 SCUs per month and 4,000 licenses receiving 1,600 SCUs per month.

The 400- and 4,000-license rows are Microsoft’s own published examples. The other rows apply Microsoft’s 400-per-1,000 formula. The 10,000-SCU monthly maximum is reached at 25,000 licenses; tenants larger than that receive the same 10,000 SCUs.

For example, in a 239-seat E5 customer scenario:

239 × 0.4 = 95.6 SCUs per month

That is the number I would use for initial financial and capacity planning. Microsoft does not state whether fractional allocations are rounded, so confirm the actual figure in the Security Copilot usage dashboard once the tenant is enabled.

This Is a Monthly Pool, Not the Old Hourly Capacity Model

This may be the most important licensing distinction.

Microsoft describes the E5/E7 entitlement as Default Security Copilot Capacity. It is automatically created when the tenant is enabled and is shared across users and Security Copilot experiences. Microsoft also says this capacity cannot be modified and is not billed hourly. Any cost values the portal displays for this capacity are informational only, not charges.

That is significantly different from traditional provisioned Security Copilot capacity. Under the provisioned model, an organization selects a number of SCUs in advance. Provisioned capacity refreshes every full billing hour, and unused capacity at the end of that hour does not roll over.

With E5/E7 inclusion, activity instead consumes from the organization’s monthly allocation.

Microsoft illustrates this with an example involving 3.5 SCUs of actual Security Copilot usage. Under a traditional five-SCU provisioned configuration across two hours, the organization would be billed for 10 SCUs of capacity. Under the E5/E7 inclusion model, those same workloads simply deduct 3.5 SCUs from the monthly included pool.

What Happens When You Run Out of Included SCUs?

This brings us to the next major consideration: Pay-As-You-Go capacity.

Microsoft’s current E5/E7 documentation says usage beyond the allocated SCUs will be throttled at a future date, and that at that time customers will have an option to scale beyond the included allocation for $6 USD per additional SCU on a Pay-As-You-Go basis.

Note that both halves of that statement are forward-looking. Microsoft does not currently document what happens when an included pool is exhausted before throttling and PAYG take effect. The “requests stop” behavior Microsoft does document applies to the provisioned model, where requests stop once provisioned SCUs run out and no other capacity type is available. For planning purposes, assume overage will eventually be either throttled or billed, and confirm the actual behavior for your tenant in the usage dashboard rather than assuming unlimited consumption.

Once available, the planning math is straightforward:

• 400 included SCUs and 450 consumed: 50 × $6 = $300
• 400 included SCUs and 600 consumed: 200 × $6 = $1,200
• 95.6 included SCUs and 120 consumed: 24.4 × $6 = $146.40

These are mathematical planning examples based on Microsoft’s stated entitlement and PAYG price, not quotes for a particular customer agreement.

Wait: Isn’t Security Copilot $4 per SCU?

Yes, and this is where the licensing conversation can become confusing. Microsoft currently publishes two prices for its traditional purchasing model:

Microsoft positions provisioned SCUs for regular, expected workloads and overage SCUs for unexpected demand. These should not be treated as interchangeable pricing models.

• The $4 model purchases hourly provisioned capacity.
• The E5/E7 entitlement provides a monthly included SCU pool.
• The $6 rate applies to usage-based overage or PAYG capacity.

Published prices are estimates. Actual pricing can vary by agreement, purchase date, currency exchange rate, and applicable taxes.

Don’t Forget the Monthly Reset

The included E5/E7 SCUs do not roll over. The allocation resets monthly, and unused capacity cannot be carried into a later month.

That changes how I would approach Security Copilot adoption. There is little reason to “save” included SCUs indefinitely. Organizations should identify valuable workflows, monitor consumption, and progressively introduce Security Copilot into security operations. Microsoft provides a usage monitoring dashboard for tracking consumption.

What Does the E5/E7 Capacity Cover?

The entitlement is not limited to a single Security Copilot interface. Microsoft says the included capacity covers core chat, promptbook, and agentic scenarios across:

• Microsoft Defender
• Microsoft Entra
• Microsoft Intune
• Microsoft Purview
• The standalone Security Copilot portal

Eligible E5/E7 customers using Microsoft Sentinel can also apply included SCUs to Security Copilot scenarios in Sentinel. Microsoft also identifies developer experiences such as Agent Builder, APIs, promptbooks, and integrations through MCP and Graph APIs as included capabilities.

Partner-built agents are a special case. Microsoft currently covers the SCU cost of running third-party agents “until further notice,” but says this might change as inclusion rolls out more broadly. Any license the partner charges for the agent itself, purchased through the Security Store, is separate.

There can still be costs outside the Security Copilot entitlement. Microsoft’s examples of what is not covered include:

• Microsoft Sentinel data lake compute or storage costs
• The non-agentic Data Security Investigations experience in Microsoft Purview
• Azure Logic Apps charges for usage with Security Copilot
• Partner-built agent licensing paid through the Security Store
• Prerequisites for some agents that involve products outside Microsoft 365 E5 and E7

From Licensing Conversation to Operational Conversation

This new model makes Security Copilot much more interesting to me from a consulting perspective. The barrier is not necessarily a separate Security Copilot purchase anymore for an E5/E7 customer. The customer may already have a meaningful amount of AI security capacity.

For a security architect, the exercise becomes determining:

1. How many eligible E5/E7 licenses exist?
2. What monthly SCU allocation does that produce?
3. Which Security Copilot experiences provide the highest operational value?
4. How quickly is the included capacity being consumed?
5. At what usage level would PAYG consumption become financially significant?

That is a healthier conversation than simply provisioning arbitrary capacity and hoping the organization uses it.

The Practical Takeaway

For every 1,000 paid eligible licenses, Microsoft provides 400 SCUs per month, proportionally scaled for smaller environments and capped at 10,000 included SCUs monthly. From there, organizations need to monitor how those SCUs are being consumed.

Microsoft lists $6 per SCU as the usage-based overage price, although its current E5/E7 inclusion documentation still characterizes PAYG scaling beyond the included allocation as a future capability with 30 days’ advance notification. Microsoft says usage beyond the allocation will be throttled once that change takes effect, so monitoring consumption protects availability as much as budget.

Security Copilot is no longer merely another security product that needs to be licensed independently. For customers already paying for Microsoft’s upper enterprise licensing tiers, it is increasingly a capacity they already own and should understand how to use.

The discussion is shifting from “How much do we need to buy?” toward “How much do we already have, where should we use it, and how do we control the cost once we exceed it?”

For Microsoft 365 E5 and E7 customers, that is a considerably more compelling place to start.

Microsoft References

• Security Copilot inclusion for Microsoft 365 E5 and E7
• Security Copilot Security Compute Units and capacity
• Understand how Security Copilot is auto provisioned for Microsoft 365 E5 and E7
• Microsoft 365 E3, E5, and E7 comparison
• Microsoft Security Copilot pricing