Microsoft Security Copilot for a 100-User Organization: What It Does and What It Costs

Microsoft publishes two rates and one rule. Provisioned capacity is $4 per SCU per hour and is billed for every hour it is provisioned whether or not it is used; at least one provisioned SCU is required. Overage capacity is $6 per SCU and is billed only for what you consume, up to an hourly limit you set. The bill lands on an Azure subscription: a metered Microsoft charge on your own account, not a line on a license invoice.

The last row changes the decision for E5 tenants; a section below quotes what Microsoft says. For everyone else the one-SCU floor is the budget number: $34,560 to $35,712 a year, against a Microsoft 365 E5 seat at $60.00 per user per month and a Business Premium seat at $22.00 (Microsoft list price, October 2026 price list).

Microsoft describes Security Copilot as a standalone portal, embedded experiences inside its security products, and a set of agents that run on a schedule. The product page groups the work into investigation and remediation (an incident summarized into a narrative with step-by-step response guidance), building and reverse-engineering scripts (a question turned into a KQL hunting query, or an obfuscated PowerShell script explained), and stakeholder reporting. The Entra documentation adds natural-language questions over users, groups, sign-in and audit logs, devices and Conditional Access policies.

The Conditional Access Optimization Agent is the one 100-user tenants adopt first, because it answers a question every tenant has: who is not covered by MFA or a device rule? Microsoft states it runs every 24 hours or on demand, reviews up to 300 users and 150 applications per run, and consumes on average less than one SCU per run. It writes the suggested policy in report-only mode; a person turns it on. Conditional Access policies every business should have is what it measures you against.

Microsoft's own billing example is the clearest description. You provision 4 SCUs with an overage limit of 6. In one hour a prompt consumes 3 SCUs and an incident summary in Defender consumes 0.5 SCU: 3.5 SCUs used, 4 billed, at $4 each, $16 for the hour. In another hour a promptbook adds 3.2 SCUs for a total of 7.2: 4 provisioned SCUs at $4 plus 3.2 overage SCUs at $6, $35.20 for the hour.

Three consequences:

• Provisioned capacity is a reservation, not a quota. An idle hour still bills the provisioned SCUs. The Entra documentation says the one required SCU is billed each month even if you consume nothing, and turning off an agent does not stop that billing.
• Overage is the safety valve. With 1 provisioned SCU and an overage limit of 5, a heavy investigation hour costs $4 plus up to $30 rather than failing.
• Consumption is per prompt, not per user. The number of people with access does not change the bill; the number and size of prompts and agent runs does. Microsoft offers a capacity calculator (Azure account required) and an in-product usage dashboard.

Capacity is bought in the Security Copilot portal or the Azure portal, and the subscription owner pays Microsoft directly; we size, deploy and operate it.

At Ignite 2025 Microsoft announced that Security Copilot agents would be built into Defender, Entra, Intune and Purview and that Security Copilot would be available to all Microsoft 365 E5 customers. Microsoft's pricing page, as checked on 11 October 2026, states the terms:

• Eligible Microsoft 365 E5 and E7 customers receive 400 SCUs per month for every 1,000 user licenses, up to 10,000 SCUs per month. Microsoft's examples are 160 SCUs a month for 400 seats and 1,600 for 4,000; the same arithmetic gives 40 for 100 seats.
• E5 customers already using Security Copilot on 18 November 2025 had the benefit from that date; other E5 and E7 customers are activated in phases with advance notice.
• Microsoft says the included capacity is expected to support typical scenarios.

Two things the page does not say, so we do not claim them: whether a tenant with the benefit still needs a paid provisioned SCU for prompts outside the embedded agents, and whether the purchase channel (CSP, Enterprise Agreement, direct) affects eligibility. Until Microsoft documents both, plan on the benefit covering agent runs and embedded summaries, and treat standalone-portal usage as a separate decision. Microsoft 365 E7 contains E5, so it carries the same benefit. For an E3 tenant, the benefit is one more entry in the E3 versus E5 arithmetic: 100 seats moving from $39.00 to $60.00 costs $25,200 more per year, which is less than one provisioned SCU.

Microsoft's published figures allow an estimate.

• An incident summary in Defender: 0.5 SCU in Microsoft's example. 40 SCUs a month is about 80 summaries, or roughly four per working day.
• A Conditional Access Optimization Agent run: on average less than one SCU, and the scanning steps that find nothing consume none. A daily run fits inside the E5 benefit with room left.
• A typed prompt in the standalone portal: 3 SCUs in Microsoft's example; a promptbook 3.2. Ten sessions a month of three prompts each is about 90 SCUs.

One provisioned SCU reserves one SCU in every hour of the month, 720 to 744 SCU-hours, far more than a 100-user tenant consumes, because the usage above is spread across a month while the unit is reserved every hour. That mismatch is the whole cost story for a small tenant: the product is priced for a team that works in it all day. The rule is 1 provisioned SCU with an overage limit of 3 to 5, reviewed after the first month on the usage dashboard.

1. An Azure subscription with an owner who will receive the bill, a resource group for the capacity, and a region.
2. The data sources: Defender for Endpoint on every device, Defender for Office 365 on mail, Entra ID P1 for the Conditional Access agent, Intune for device-based suggestions.
3. Roles. Microsoft requires Security Administrator to activate the Conditional Access agent the first time; Conditional Access Administrator and Security Administrator act on its suggestions; Security Reader and Global Reader only view.
4. Provision 1 SCU, set the overage limit, and confirm the first day's charge.
5. Turn on one agent, review its first suggestions with the owner of Conditional Access, and move the resulting policy from report-only to on after a week.
6. Add the Defender embedded experiences for the people who triage incidents, then read the usage dashboard at 30 days.

Our Security Copilot deployment and SOC automation service is $5,950 per project, quoted in writing before work begins, and covers steps 1 to 6 with the promptbooks and agent configuration for your tenant.

Security Copilot makes a person who is already looking at the queue faster. It does not look at the queue for you; a tenant with no security staff gets a shorter summary that nobody reads at 2 a.m. The question to answer before buying capacity is the one the Sentinel sizing article and MDR: why a SIEM alone is not enough ask: who closes incidents every day?

The comparison that settles it: one provisioned SCU costs about twice a year of managed detection, and the service brings people. If the tenant later grows a security function, the SCU is a one-day addition. Which stack those people watch is covered in Defender XDR and Sentinel vs third-party tools.

How much does Microsoft Security Copilot cost per month?

$4 per provisioned security compute unit per hour, with a minimum of one provisioned SCU, plus $6 per overage SCU consumed. One SCU for a 30-day month is $2,880; a 31-day month is $2,976. The charge is metered on your Azure subscription (Microsoft's Security Copilot pricing page, checked 11 October 2026).

Is Security Copilot included in Microsoft 365 E5?

Microsoft's pricing page states that eligible Microsoft 365 E5 and E7 customers receive 400 SCUs per month for every 1,000 user licenses, up to 10,000 per month, activated in phases after the Ignite 2025 announcement. A 100-seat tenant gets 40 SCUs a month by Microsoft's own examples; whether a paid SCU is still needed for the standalone portal is not stated.

What is a security compute unit?

Microsoft defines an SCU as the unit of compute used to run Security Copilot workloads in the standalone and embedded experiences. Microsoft's example prices an incident summary at 0.5 SCU, a prompt at 3 SCUs and a promptbook at 3.2 SCUs; the Conditional Access Optimization Agent uses on average less than one SCU per run.

Do I need Microsoft Sentinel to use Security Copilot?

No. Microsoft lists Sentinel among the integrated products alongside Defender XDR, Entra, Intune, Purview and Defender for Cloud. A tenant with Defender XDR and Entra ID can use the embedded experiences and agents without a Sentinel workspace.

Does Security Copilot replace a managed detection and response service?

No. It shortens investigation for someone already doing the work. A managed service supplies the people who watch the queue; at $15 per user per month for 100 users it costs about half of one provisioned SCU for a year.

• Microsoft Security Copilot pricing — Microsoft, checked 2026-10-11 (SCU rates, minimum, overage, billing example, E5 and E7 benefit)
• Microsoft Security Copilot — Microsoft, checked 2026-10-11 (embedded experiences, agents, integrations)
• Microsoft Entra Conditional Access Optimization Agent — Microsoft Learn source on GitHub, ms.date 06/23/2026, checked 2026-10-11
• Microsoft Entra agents — Microsoft Learn source on GitHub, ms.date 01/21/2026
• Microsoft Security Copilot scenarios in Microsoft Entra ID — Microsoft Learn source on GitHub, ms.date 09/23/2025
• Microsoft list price, October 2026 price list, US commercial, for the seat prices quoted