Microsoft Security Copilot

What it does

Microsoft Security Copilot takes in security and IT signals from Microsoft security products and produces summaries, investigation guidance, step-by-step response steps, and stakeholder reports. It also translates natural language into query-language scripts and helps analyze suspicious code. Its agents, such as a phishing triage agent and a conditional access optimization agent, are built into products like Defender, Entra, Intune, and Purview.

Security teams use it to triage complex alerts, gather incident context, and follow guided remediation. Users can also run promptbooks and partner-built or community-built agents. What distinguishes it is that agents operate inside the tools analysts already use, drawing on data from Microsoft Sentinel, Defender XDR, and Azure security services, and that it is available as a standalone experience or within Microsoft 365 E5.

It suits security operations and IT administration teams in organizations that use Microsoft security products. Access depends on a Security Copilot subscription measured in security compute units, or on the Microsoft 365 E5 benefit, which is being rolled out in phases. Pricing is usage-based and varies by agreement, so teams should estimate capacity with the Azure pricing calculator before committing.

What it can do

• Summarizes security signals and alerts into key insights and incident context
• Runs embedded agents for tasks such as phishing triage and alert triage
• Provides step-by-step incident response and remediation guidance
• Translates natural language into query-language scripts and reverse-engineers malicious scripts
• Generates stakeholder reports summarizing context, open issues, and protective measures
• Supports partner-built and community-built agents without coding for community agents

Works with

• Microsoft Sentinel
• Microsoft Defender XDR
• Microsoft Intune
• Microsoft Entra
• Microsoft Purview
• Microsoft Defender for Cloud
• Microsoft Defender External Attack Surface Management
• Azure Web Application Firewall
• Azure Firewall

Example workflows

Phishing triage

Input: a queue of reported emails. Steps: the Phishing Triage Agent in Defender reviews each message and classifies it. Output: triaged emails with malicious and false-positive alerts separated for analyst review.

Incident briefing

Input: an active alert in Defender. Steps: the user requests incident summarization and step-by-step response guidance. Output: a condensed incident summary and suggested remediation steps for the analyst to follow.

Before you choose

• Billing is hourly for provisioned SCUs with a minimum of one, plus overage charges up to a limit you set, so monitor the usage dashboard.
• Microsoft 365 E5 included capacity of 400 SCUs per 1,000 licenses is rolling out in phases, so availability for your tenant may not be immediate.
• Pricing estimates are indicative only and vary by agreement, currency, and date of purchase.

Listed under

• Security
• Enterprise
• Incident response
• IT admins
• IT teams
• Phishing triage
• Security analysts

Get started

Purchase SCUs in the Security Copilot product or Azure portal, or access through Microsoft 365 E5 when available.

1. Confirm you have Microsoft Defender, Entra, Intune, or Purview in use, since agents run inside those products.
2. Estimate required capacity with the Azure pricing calculator, which requires an Azure account.
3. Provision SCUs in the Security Copilot product or Azure portal, or confirm access through your Microsoft 365 E5 subscription.

Provisioned SCUs are billed hourly with a minimum of one, and overage SCUs are billed on usage up to an optional hourly limit. Microsoft 365 E5 customers may receive included SCUs at 400 per 1,000 licenses, up to 10,000 per month. Rates are estimates and vary by agreement. A free trial link is listed on the page, but its length is not stated.

Source: azure.microsoft.com/en-us/pricing/details/microsoft-security-copilot, checked 28 Oct 2026. Prices can change; check before you buy.

Sources for this overview

Product pages, documentation, and pricing checked 28 Oct 2026. Each source supports part of the overview; availability and prices can change.

• Microsoft Security Copilot | Microsoft Security ↗www.microsoft.com
• Microsoft Security Copilot – Pricing | Microsoft Security ↗azure.microsoft.com

Company website

microsoft.com: product, pricing and policy pages

YC directory mirror

Batch and company name

Web search

Confirms the official site

Social accounts

Accounts the company links, and its posts on X

Human review

Checked by a person

knowledge_base

Last checked 28 Oct 2026. Every field keeps its source and date; unknown means we couldn’t confirm it.