Security Copilot Is Now Free for M365 E5 Customers

The Problem: Security Copilot looked amazing, but at $4/hour (per SCU) the pricing felt unpredictable. Hard to justify without knowing exactly what you’d spend.

The Nugget: As of Ignite 2025, Microsoft Security Copilot is now included at no additional cost for all Microsoft 365 E5 customers. No extra purchase, no provisioning – it just activates.

What You Get:

Users LicensedSCUs per MonthValue400 users160 SCUs~$6401,000 users400 SCUs~$1,6005,000 users2,000 SCUs~$8,00025,000+ users10,000 SCUs (max)~$40,000

What’s an SCU? Security Compute Unit – the currency Security Copilot uses. Every prompt, investigation, or agent action consumes SCUs. The included amount covers typical daily security operations.

Where It Works:

• Microsoft Defender – Incident triage, threat hunting

• Microsoft Entra – Conditional Access optimization, identity investigations

• Microsoft Intune – Device compliance, endpoint security

• Microsoft Purview – Data security, insider risk

• Microsoft Sentinel – SIEM investigations (if you have Sentinel)

Built-in Agents Included:

• Phishing Triage Agent

• Conditional Access Optimization Agent

• Vulnerability Remediation Agent

• Threat Intelligence Briefing Agent

• …and 70+ more from Microsoft & partners

Rollout Timeline:

• ✅ Now: Existing Security Copilot + E5 customers

• 🔜 Coming months: All other E5 customers (30-day notice before activation)

Need More SCUs? Pay-as-you-go at $6 per SCU when you exceed your allocation.

Pro Tip: Use the SCU Calculator to estimate if your included allocation covers your security workloads.

Admin context

For Microsoft admins, the practical point in Security Copilot Is Now Free for M365 E5 Customers is to treat the change as something that should be validated before it becomes tenant-wide behavior. Check the affected users, devices, assignments and support process so the Nugget turns into a controlled operational improvement instead of another undocumented setting.

Operational follow-up

As an additional operational note, Security Copilot Is Now Free for M365 E5 Customers should be reviewed together with your existing Microsoft 365 change process. Even small platform changes can affect helpdesk instructions, user communication, device targeting, reporting expectations and the way administrators explain the result to stakeholders.

Runbook notes for Security Copilot Is Now Free for M365 E5 Customers

Security Copilot Is Now Free for M365 E5 Customers deserves a little more operational context because the decision usually affects security operations AI. The related items are Security Copilot, Microsoft 365 E5, analyst workflow, incident review, role assignment. Treat this Nugget as a starting point for a concrete tenant decision: who is in scope, which Microsoft portal or policy is touched, and what visible result should confirm that the configuration worked.

When validating Security Copilot Is Now Free for M365 E5 Customers, keep the test narrow enough to understand the result. Select one representative user, device, workload or subscription, capture the current state, then apply the change and compare the outcome. This avoids guessing later when support sees a different enrollment state, access result, model response, update status or admin center signal.

The most useful documentation for Security Copilot Is Now Free for M365 E5 Customers is practical rather than theoretical. Record the assignment logic, the owner, the expected monitoring view and the exception path. If the change affects users, include the wording support teams should use when they explain the behavior. If it affects devices or services, include the exact place where administrators can verify health.

For search consistency, keep the phrase Security Copilot Is Now Free for M365 E5 Customers connected to the body text, the internal links and the category context. That helps readers understand why this Microsoft admin topic belongs with the surrounding Intune, Entra, Azure, Copilot, Security or automation Nuggets, and it gives AI search systems clearer signals about the real subject of the page.

Revisit Security Copilot Is Now Free for M365 E5 Customers after the next rollout wave or Microsoft service update. Cloud behavior, licensing boundaries and portal labels can move quickly, so a short review prevents stale instructions. Confirm that the original assumption is still true, remove obsolete exceptions, and update the runbook if the operating model changed.

A clean handover for Security Copilot Is Now Free for M365 E5 Customers should also include a fallback. Write down how the team pauses the change, narrows the scope, or returns to the previous configuration if the result creates noise. This makes the Nugget safer to use in production because the implementation path includes both the happy path and the recovery path.