Microsoft Security Copilot

What is Microsoft Security Copilot?

Microsoft Security Copilot is a generative AI service that helps security and IT teams protect, detect and respond to threats using agentic AI. It works across Microsoft security products and partner solutions.

Key capabilities of Microsoft Security Copilot

• Embedded agents: Ready-to-use agents in Microsoft Defender, Entra, Intune and Purview
• Phishing Triage Agent: Microsoft says analysts identified malicious emails up to 550% faster
• Conditional Access Optimization Agent: Found 204% more missing zero trust policies per Microsoft
• Custom and partner agents: Supports third-party and custom-built agents
• Multi-product integration: Microsoft Sentinel, Defender XDR and Defender for Cloud
• SCU capacity model: Security Compute Units meter workload execution

How Microsoft Security Copilot works

Teams use Security Copilot inside Microsoft security tools or standalone. Agents run tasks such as phishing triage and policy optimization, drawing on connected products like Sentinel and Defender XDR. Capacity is measured in Security Compute Units.

Who uses Microsoft Security Copilot?

Security operations, identity and IT administrators in organizations on the Microsoft security stack.

Microsoft Security Copilot pricing

Security Copilot is included in Microsoft 365 E5 and E7 at 400 SCUs per month per 1,000 user licenses, with a phased rollout. A standalone per-SCU option exists, and third-party sources report about $4 per SCU per hour.

Microsoft Security Copilot alternatives

Alternatives include CrowdStrike Charlotte AI for endpoint security, SentinelOne Purple AI for threat hunting and Moveworks for IT support.