A lean SOC can gain time from AI-assisted investigation, but idle compute capacity can turn a small experiment into a large Azure bill. Microsoft Security Copilot pricing follows a capacity-based pricing model, so lean security teams need a plan for usage rather than a simple count of analyst seats.
As of July 31, 2026, Microsoft offers Security Copilot through Azure capacity and includes a monthly entitlement for eligible Microsoft 365 E5 and E7 customers. This Microsoft 365 E5 inclusion can help security operations benefit from AI assistance, but the right option still depends on your license base, operating hours, and the investigations your team wants to accelerate.
Key Takeaways
- Microsoft Security Copilot uses Security Compute Units (SCUs), so pricing depends on provisioned capacity and operating hours rather than analyst headcount or named-user licenses.
- Microsoft’s published US standalone rate is $4 per SCU per hour for provisioned capacity and $6 per SCU per hour for capacity used above the provisioned level; regional pricing and enterprise terms can change the final cost.
- Eligible Microsoft 365 E5 and E7 tenants receive an included monthly SCU pool of 400 SCUs per 1,000 paid user licenses, subject to a 10,000-SCU monthly cap and current eligibility terms.
- Lean SOCs can control costs by scheduling capacity around investigation windows, monitoring consumption, and starting with a time-boxed pilot instead of running SCUs continuously.
- A defensible budget should compare SCU charges with measurable analyst time saved, while keeping Microsoft Sentinel, Microsoft Defender, Microsoft 365, Azure, and integration costs separate.
Microsoft Security Copilot pricing: What lean SOCs actually buy
Microsoft Security Copilot uses Security Compute Units (SCUs). An SCU is a unit of AI processing capacity, rather than a named-user license. The product isn’t priced per prompt, case, or alert, so Security Compute Units represent shared processing capacity for the tenant.
For a standalone purchase, Microsoft’s US pricing lists provisioned capacity at $4 per SCU per hour. This hourly billing model applies to capacity configured through the Azure portal. Capacity used above the provisioned level is priced at $6 per SCU per hour. Check the current Microsoft Security Copilot pricing page before approving a standalone purchase, since regional rates, currency, taxes, and enterprise agreements can change the final amount.
The billing unit matters because SCUs run by time. One SCU left provisioned for a 730-hour month produces an illustrative charge of $2,920 at the published $4 hourly rate. That number is not a Microsoft quote. It is simple arithmetic: 730 hours multiplied by $4.
A SOC manager shouldn’t treat the Security Compute Units pricing model as an add-on for every analyst. Instead, treat the product as shared provisioned capacity. Analysts access Security Copilot through tenant roles and supported Microsoft security tools, while the organization pays for the capacity pool.
This pricing model fits teams that want SCUs during a limited pilot or for a tightly defined workflow. It can also become expensive when an owner leaves capacity running after the pilot ends.
A single SCU operating around the clock costs far more than a typical per-user software add-on, so capacity schedules need the same attention as cloud compute schedules.
E5 and E7 customers have an included SCU pool
Eligible Microsoft 365 E5 and E7 tenants receive Security Copilot capacity without a separate charge for the included allocation. Under the Microsoft 365 E5 inclusion, Microsoft’s documentation states that customers get 400 SCUs per month for every 1,000 paid user licenses, up to 10,000 SCUs per month. These SCUs, or Security Compute Units, represent the available processing capacity.
The allowance works out to 0.4 SCUs per paid license each month. A company with 500 qualifying E5 licenses receives 200 SCUs in its monthly allocation. A company with 2,500 licenses receives 1,000 SCUs. Microsoft applies the 10,000-SCU ceiling even when the seat calculation would produce a larger amount.
The Microsoft 365 E5 inclusion is a tenant-level monthly pool, not an allocation assigned to each user. Usage can be generated by workflows that analyze signals from Microsoft Defender, Microsoft Entra, Microsoft Purview, Microsoft Intune, and Microsoft Sentinel. These services provide much of the security context that Security Copilot uses, so the relevant licensing requirements and connected workloads matter when estimating demand.
See Microsoft’s E5 and E7 inclusion documentation for the current eligibility terms and cap. The Microsoft 365 E5 inclusion does not roll over into the next month, and teams should confirm how Microsoft Defender, Microsoft Entra, Microsoft Purview, Microsoft Intune, and Microsoft Sentinel data contributes to consumption in their tenant.
That distinction changes the budget conversation. An organization already committed to E5 may have enough included capacity to test priority workflows before buying Azure capacity. However, the E5 or E7 license cost remains a separate licensing decision. Security Copilot inclusion alone does not justify upgrading hundreds of users.
The included pool also has a practical limit. When usage reaches the monthly allocation, the tenant may face throttling unless it has an available paid expansion option. Teams should confirm their tenant’s behavior and controls with Microsoft before depending on overflow during an incident.
Estimate SCU costs with operating hours, not headcount
A useful forecast starts with the hours you need active compute capacity. A five-person SOC that works business hours may need less provisioned capacity than a two-person team supporting a 24/7 environment. This pricing model makes hourly billing more important than headcount alone.
The following figures use Microsoft’s published US standalone rate of $4 per SCU per hour and a 730-hour month. They are illustrative estimates, not published price commitments. The scheduled scenarios assume the team provisions capacity only during the stated hours and deprovisions it for the rest of the month, which keeps hourly billing aligned with actual operating windows.
| Scenario | Capacity assumption | Monthly hours | Illustrative monthly SCU cost |
|---|---|---|---|
| Focused pilot | 1 SCU, 8 hours a day, 5 days a week | 173 hours | $692 |
| Business-hours SOC | 2 SCUs, 8 hours a day, 5 days a week | 346 hours | $1,384 |
| Continuous baseline | 1 SCU, 24 hours a day, 7 days a week | 730 hours | $2,920 |
| Continuous two-SCU capacity | 2 SCUs, 24 hours a day, 7 days a week | 1,460 hours | $5,840 |
The table shows why a team should begin with operating windows. Two SCUs during weekday investigation hours cost less than one SCU that runs all month. Still, scheduled capacity only works if someone owns the process and the SOC can tolerate reduced Copilot access outside those windows.
Overage needs more caution. At $6 per SCU per hour, a continuous month of one overage SCU would equal $4,380 using the same 730-hour assumption. Treat that overage capacity as a planning sensitivity, not a budget forecast, unless your tenant’s overflow terms confirm availability, behavior, and any overage limit.
Also separate Security Copilot cost from the rest of the security stack. Microsoft Sentinel data ingestion and retention, Microsoft Defender products, Microsoft 365 licensing, Azure storage, and third-party integrations can all affect the total operating budget. Microsoft Sentinel and Microsoft Defender integrations may also influence how much compute capacity your team uses, but Security Copilot does not replace those costs under this pricing model.
Measure consumption before committing to 24/7 capacity
The first month should answer an operational question: which repetitive incident response tasks save enough analyst time to pay for capacity? Broad, open-ended use can consume capacity without producing a measurable result, particularly when security operations teams haven’t defined a clear outcome.
Start with a small number of recurring tasks. For many lean teams, strong candidates include incident summaries, phishing triage, endpoint investigation summaries, Kusto Query Language assistance, identity investigation context, and threat intelligence enrichment. Promptbooks can standardize these workflows, while autonomous agents and agentic automation can support repeatable triage as AI security capabilities mature.
Then track four measures:
- Record SCU use by day, shift, and use case, not only the end-of-month total, including consumption for threat intelligence research.
- Compare analyst time per incident before and after Security Copilot access, especially for incident response.
- Track whether Copilot outputs, promptbooks, or autonomous agents reduce duplicate work or improve investigation notes.
- Review escalations and false-positive handling, because fast summaries are not the same as correct decisions for security operations.
Microsoft’s Security Copilot onboarding guidance helps teams set up the service under the correct licensing path and confirm licensing requirements. Access roles should remain narrow during a pilot, especially where prompts can draw context from security data.
A 30-day pilot with one use case often produces a clearer budget signal than enabling every available feature on day one. For example, a SOC may find that phishing investigations create repeatable value, while ad hoc natural-language queries do not justify always-on capacity. This approach also shows whether autonomous agents deliver measurable savings before the team commits to broader deployment.
Build a value case that survives renewal scrutiny
Security Copilot’s value is strongest when AI security reduces work that delays incident response. At Ignite 2025, Microsoft highlighted autonomous agents and specialized promptbooks that can help analysts summarize alerts, investigate incidents, and document decisions across Microsoft Defender and Microsoft Entra. Faster results matter when they help an analyst close routine cases, escalate credible threats, or apply threat intelligence sooner. A polished answer that still requires complete manual verification has less financial value.
Set a realistic comparison. If a team spends 20 analyst hours each month validating common phishing alerts, calculate the fully loaded cost of those hours. Then compare the reduction in effort against the monthly SCU charge and the time needed to administer capacity. Include workflows spanning Microsoft Intune and Microsoft Purview, where AI security can reduce repetitive investigation and compliance documentation.
Measure the work that autonomous agents and agentic automation actually remove, rather than assuming they replace analysts. Microsoft Defender, Microsoft Entra, Microsoft Intune, and Microsoft Purview still require human oversight for sensitive decisions. Specialized promptbooks can standardize routine research, while autonomous agents can organize evidence and apply threat intelligence, but neither owns incident decisions, tunes detections, or carries accountability for containment.
The best Microsoft Security Copilot pricing plan is usually a staged one. Use the E5 or E7 pool first when eligible. Otherwise, run a time-boxed Azure capacity pilot, test the promptbooks and autonomous agents discussed at Ignite 2025, measure the work saved, and only then decide whether continuous provisioned capacity has a defensible cost. This gives a lean team a business case for AI security that can survive renewal scrutiny.
Frequently Asked Questions
How is Microsoft Security Copilot priced?
Microsoft Security Copilot is priced through Security Compute Units (SCUs), which represent shared AI processing capacity for a tenant. Standalone Azure capacity is listed at $4 per SCU per hour in the US, while capacity above the provisioned level is listed at $6 per SCU per hour.
Is Microsoft Security Copilot included with Microsoft 365 E5?
Eligible Microsoft 365 E5 and E7 tenants receive an included monthly SCU allocation rather than unlimited Security Copilot usage. The documented allowance is 400 SCUs per month for every 1,000 paid user licenses, with a maximum of 10,000 included SCUs per month.
Does each analyst receive a separate SCU allocation?
No. SCUs are pooled at the tenant level and support users and workflows across connected Microsoft security tools. The organization manages shared capacity rather than assigning a fixed SCU allowance to each analyst.
How can a lean SOC reduce Security Copilot costs?
Schedule SCUs only during the hours when the SOC performs investigations, and deprovision unused capacity after a pilot or operating window. Teams should also monitor consumption by use case and set controls for potential overage before enabling broader access.
What costs are not included in the Security Copilot price?
Security Copilot pricing does not replace costs for Microsoft Sentinel ingestion and retention, Microsoft Defender products, Microsoft 365 licenses, Azure storage, or third-party integrations. These services should be estimated separately when building the total security operations budget.
The practical cost decision for a lean SOC
Microsoft Security Copilot pricing is based on compute capacity, so the financial risk comes from unused hours rather than unused accounts. Security Compute Units (SCUs) are consumed as workloads run, making the published $4 per SCU per hour rate manageable for a targeted pilot but substantial when compute capacity runs around the clock. Updates discussed at Ignite 2025 may also affect how teams plan licensing requirements and security operations budgets.
For E5 and E7 customers, the included monthly SCU pool creates a lower-risk starting point. Other teams should use the Azure portal to monitor SCUs, set an overage limit, and manage any overage capacity before costs expand. A narrow use case, an owner for capacity schedules, and measured analyst time savings remain the clearest path to a defensible Security Copilot budget and a second look at compute capacity.
