Microsoft Security Copilot Now Included with Microsoft 365 E5: What It Means for Your Cybersecurity Team

In a major shift for enterprise security, Microsoft has announced that Microsoft Security Copilot, its AI-powered security assistant, is now included with Microsoft 365 E5 licences at no extra cost starting in November 2025.

This change makes advanced AI security capabilities more accessible for organisations that already invest in Microsoft 365 E5, helping security teams work smarter and faster with built-in AI support for threat detection, investigation, and response.

In this blog, we will discuss what’s changed, why it matters, and how organisations can get value from this inclusion.

What Changed with Microsoft 365 E5

Previously, Microsoft Security Copilot was a separate premium add-on, often purchased with unpredictable compute unit costs. Under the new model:

• Security Copilot is now included with Microsoft 365 E5: It means all E5 customers automatically gain access with no additional licensing fees.
• Microsoft will give customers 30 days’ advance notice before activation in their tenant.
• Organisations receive a monthly allocation of Security Compute Units (SCUs) that scale with the number of E5 users.

The monthly SCU allocation provides the capacity to run Security Copilot workflows, experiment with its features, and integrate AI into security operations without unpredictable spending.

This update applies only to Microsoft 365 E5 licences; it does not automatically include other licence types such as Microsoft 365 E3.

How the New Model Works

Included AI capacity (Security Compute Units):

• E5 customers receive 400 SCUs per month for every 1,000 E5 users, proportionally scaling with licence count.
• At scale, larger tenants can receive up to 10,000 SCUs per month, included as part of their subscription.

SCUs represent the compute units used by Security Copilot’s AI processes, essentially powering AI workloads like alert summarisation, pattern analysis, and guided investigation.

Integration with existing security tools:

Security Copilot works inside the security products E5 customers already use, including:

• Microsoft Defender
• Microsoft Entra
• Microsoft Intune
• Microsoft Purview
• The standalone Security Copilot portal

This means analysts and administrators can access AI-driven insights inside familiar tools, helping speed up workflows without requiring users to adopt completely new platforms.

Agent Builder and API access:

E5 customers also gain access to Agent Builder and APIs, enabling the development of custom Copilot agents and integrations across their Microsoft ecosystem.

Why This Matters for IT and Security Leaders

The inclusion of Microsoft Security Copilot with Microsoft 365 E5 is more than a licensing change; it’s a strategic shift that makes AI-assisted security practical and predictable for enterprise customers.

1. Predictable Cost and Licensing

Security Copilot is now part of the E5 licence, eliminating surprise charges or unpredictable pricing tied to external Copilot compute purchases. The monthly SCU pool gives a known, budgetable amount of AI capacity that organisations can plan around.

2. Easier Experimentation

Without the need to procure separate licences or compute units, teams can start experimenting with Security Copilot quickly. Organisations can run real-world use cases, such as alert triage or incident investigation, using the capacity they already own.

3. Seamless Security Tool Integration

Because Security Copilot works within Defender, Entra, Intune, and Purview, security professionals don’t need to context-switch between disparate tools. AI insights are delivered where analysts already operate.

4. Strengthened ROI on Microsoft 365 E5

Microsoft 365 E5 already includes a broad set of advanced security, compliance, and analytics tools. Adding Security Copilot strengthens that investment, bringing AI directly into the heart of these capabilities.

What’s Included in the Microsoft 365 E5 Entitlement

The E5 licence includes the following components related to Security Copilot:

Included with no extra cost at baseline:

• Monthly SCU pool based on user count.
• Core agent experiences integrated into Defender, Entra, Intune, and Purview.
• Access to the Security Copilot portal.
• Agent Builder and APIs for creating custom AI extensions and workflows.

Not included by default:

• SCU capacity beyond the monthly included pool.
• Azure Logic Apps usage.
• Microsoft Sentinel data lake compute or storage.
• Third-party partner licences or fees.
• Some non-agent Purview experiences.

Customers who need more capacity later can expect options to purchase additional SCUs on a pay-as-you-go basis, although Microsoft will provide advance notice before that option is enabled.

How Exigo Tech Helps You Maximise Microsoft Security Copilot

Owning Microsoft 365 E5 and having access to Security Copilot is only the first step. Real impact comes from effective enablement and integration.

At Exigo Tech, we help organisations:

• Understand what Security Copilot provides under Microsoft 365 E5.
• Define high-impact use cases aligned to security priorities.
• Integrate AI insights into daily workflows.
• Measure value, such as improved response times or alert reduction.
• Optimise Security Compute Unit usage over time.

We don’t just help you adopt Security Copilot; we help you use it in ways that deliver measurable security outcomes.