Microsoft Security Copilot Deployment and SOC Automation

A working Security Copilot for your SOC, in three weeks, for a fixed $5,950: a capacity model you approve, a workspace with the right geography and roles, owner settings and audit logging set deliberately, the Microsoft plugins connected and verified, up to six agents and promptbooks enabled and tuned on a pilot week of your real alerts, two automations into Sentinel playbooks or Logic Apps, usage monitoring with cost alerts, an enablement session and a handover pack. It is the operationalization of an entitlement you already hold — not a Sentinel or Defender rollout, and not ongoing monitoring.

Very likely yes. Microsoft's Message Center notice MC1261596 announced that Security Copilot is included with Microsoft 365 E5 and E7, with a phased, zero-click rollout between 20 April and 30 June 2026: Microsoft created a default capacity and workspace in eligible tenants, set the data-storage location to your Entra geography and let several administrator roles inherit owner or contributor access. Open the Security Copilot portal with a Global or Security Administrator account and you will see it. The first thing we do is check what is already switched on and drawing capacity.

Microsoft's rule at the time of writing is 400 Security Compute Units a month for every 1,000 paid E5 or E7 user licenses, scaled proportionally for smaller counts — so a 500-seat tenant gets about 200 a month and a 2,500-seat tenant about 1,000 — capped at 10,000, reset monthly, with nothing carried over. The pool is a consumption budget: prompts, promptbooks and agents draw it down, and the usage dashboard shows the draw per hour. Whether it is enough depends entirely on which agents you run and how much alert volume they see, which is why the first deliverable is a capacity model and the pilot week measures real draw before we hand over.

By Microsoft's current description, an exhausted E5 allocation throttles Security Copilot until the next monthly reset — prompts and agents pause rather than generating a bill — unless you have attached paid provisioned or overage capacity to the workspace. Microsoft has been adjusting how included and paid capacity combine, so we confirm the behavior in your tenant during sizing, put the overage decision in writing, and design agent schedules so the pool lasts the month. Any paid capacity is Microsoft's charge on your Azure subscription, not part of this fee.

Yes. Security Copilot is sold standalone as provisioned Security Compute Units on an Azure subscription in your tenant — a minimum of one SCU, billed by the hour, with optional overage. Microsoft's published example at the time of writing is $4 per provisioned SCU and $6 per overage SCU. The engagement is the same; the sizing step just starts from a purchase decision rather than an allocation, and we set an Azure Cost Management budget on the capacity resource so nobody discovers the meter on the invoice.

Up to six from Microsoft's catalog that match your licenses and your pains. In Microsoft Defender: the Phishing Triage Agent (generally available for user-reported email; needs Defender for Office 365 Plan 2 and unified RBAC) and its preview extension, the Security Alert Triage Agent, for identity and cloud alerts; the Threat Intelligence Briefing Agent, which schedules briefings built from Microsoft Threat Intelligence and your exposure data. In Microsoft Entra: the Conditional Access Optimization Agent. In Intune: the Vulnerability Remediation Agent. In Purview: the Data Security Triage Agent for DLP and Insider Risk alerts. Each gets a dedicated agent identity with a least-privilege role, a scope, a schedule, a human reviewer and a week of tuning. Partner-built agents from the Security Store are outside the fixed price.

A promptbook is a saved sequence of prompts that runs as one unit against your connected plugins — the repeatable part of an analyst's day. We adapt four house promptbooks to your tenant: an incident summary (what happened, entities, timeline, severity, recommended next steps), an investigation (related alerts, user and device risk, sign-in and process context), KQL-assisted hunting that drafts and runs queries in Sentinel or Defender advanced hunting, and an executive or weekly report. They are saved and shared in the workspace, and two of them can be the ones the automations call.

Typical pairs are an incident-created automation rule in Sentinel that runs a Logic Apps playbook calling the Security Copilot connector — submit the incident-summary promptbook, write the result to the incident and post to Teams — and a scheduled Logic App that distributes the Threat Intelligence Briefing to your leads. Sentinel makes the first one elegant, but it is not required: both can run as Logic Apps against Defender and the Security Copilot connector. Actions are limited to summaries, enrichment, comments, notifications and reports unless you approve containment in writing.

No. The agents triage and recommend; your analysts review verdicts, give feedback the agent learns from, and decide. Microsoft requires that the humans overseeing an agent hold permissions equal to or higher than the agent's, and we set every agent up that way. We make no claim about detection rates, accuracy or time saved — the pilot week and the usage dashboard give you your own numbers.

Prompts, responses and workspace data are stored in the customer-data storage geography chosen when the workspace is created — the default workspace follows your Entra geography, Microsoft offers a short list of geographies, and the choice is permanent for that workspace. Security Copilot activity can be logged to Microsoft Purview audit (we turn it on; Microsoft's default retention is 180 days, extendable with a Purview retention policy), and the data-sharing options — whether Microsoft may capture data to improve the product — are set as you decide at kickoff and written into the configuration record.

The project is a fixed $5,950, quoted in writing before work begins and paid after you approve delivery. Not in the price: the Security Compute Units Security Copilot consumes — your E5 allocation, or provisioned and overage SCUs billed by Microsoft to your Azure subscription — Microsoft licensing, Sentinel deployment, ongoing monitoring, incident response, Defender product rollouts, custom agents and partner-built agents. The full exclusions list is on this page.

Three weeks: sizing and foundation in week 1, agents and promptbooks with the pilot week in week 2, automations, monitoring, tuning review and handover in week 3. We need the entitlement in place (E5/E7 allocation provisioned or standalone capacity bought), a Global or Security Administrator to onboard and approve our time-bound GDAP access, the kickoff decisions on geography, data sharing, agents and reviewers, and a security lead plus one or two analysts who can review agent verdicts during the pilot week.

Yes — that is a common starting point. Week 1 inventories what is enabled and what each item draws on the usage dashboard, then we pause what is not earning its capacity, trim inherited owner access, restrict plugins to the agreed set, put agents on schedules and scopes, and re-baseline the model. The rest of the engagement is the same.

Your team runs Security Copilot with the handover pack: agent register, promptbook library, runbooks, the capacity model and a review cadence. If you buy your Microsoft licensing through IT Partner, questions after handover go to the same support queue that already includes unlimited break-fix support during business hours; deeper changes — new agents, new automations — are quoted separately. Around-the-clock operation of the queue is Microsoft Sentinel SIEM/SOAR Ongoing Monitoring or Managed Detection and Response, both linked below. There is no minimum term and no lock-in on our side.

Yes, and we say so wherever it matters: the Security Alert Triage Agent's identity and cloud alerts, Natural language to KQL for Sentinel, and the newer Conditional Access Optimization Agent enhancements were in preview at the time of writing. Preview features can change or be withdrawn by Microsoft, so we enable them only when you accept that, and the handover pack marks each one.