Microsoft 365 Copilot vs Security Copilot Pricing, Licensing and Which One to Buy
Try it live
Watch AgentShield block an attack in real time.
Pick a scenario and drive the inspection lane yourself. No signup needed.
Run a request
Runs the live engine on your text. Nothing is stored, no account needed.
Inspection lane
INSPECTINGPolicy trace
High-risk action held for approval
Audit trail
- § · → → →
Microsoft 365 Copilot and Microsoft Security Copilot are unrelated products that share a brand, and buying one does nothing to secure the other. Microsoft 365 Copilot, renamed simply Microsoft Copilot during 2026, is a productivity assistant licensed per user that reads your mail, files and chats to draft and summarize. Microsoft Security Copilot is an assistant for your security operations team, billed by Security Compute Unit, that helps analysts investigate incidents. If you are trying to reduce the risk created by rolling out the first one, the second one is not the answer, and several teams have approved capacity spend believing otherwise.
The confusion is understandable and it is getting worse rather than better. Microsoft now runs at least four products with Copilot in the name: Microsoft Copilot for productivity, Microsoft Security Copilot for the SOC, GitHub Copilot for developers, and Copilot Studio for building agents. They have different licenses, different admin centers and different threat models.
What is the difference between Microsoft 365 Copilot and Microsoft Security Copilot?
Microsoft 365 Copilot is AI applied to your business data. Microsoft Security Copilot is AI applied to your security work. The first one creates a governance problem because it reads everything a user can read. The second one is a productivity tool for the people who have to clean that problem up. One is a workload to be secured, the other is staffing leverage for the team doing the securing.
| Microsoft 365 Copilot (Microsoft Copilot) | Microsoft Security Copilot | |
|---|---|---|
| Buyer | IT and productivity leadership, usually funded from a digital workplace budget | Security operations, funded from the security budget |
| Users | Every information worker you license | Analysts, incident responders, security admins |
| Data it touches | Mail, files, chats, meetings and calendar through Microsoft Graph, scoped to each user permissions | Security signals, incidents and threat intelligence from your security stack |
| Pricing model | Per user per month, annual commitment, on top of a required base suite license | Capacity based, billed by Security Compute Unit, minimum one provisioned SCU billed hourly |
| Admin surface | Microsoft 365 admin center and Microsoft Purview | Security Copilot portal and Microsoft Defender |
Microsoft 365 Copilot vs Security Copilot pricing
The two products are priced on completely different models, which is the practical reason they should never be compared line for line on a spreadsheet.
Microsoft 365 Copilot carries a list price of 30 USD per user per month on an annual commitment, verified August 2026. The number that catches finance teams out is that you cannot buy it standalone: it sits on top of a base suite license, and Microsoft raised base suite prices on July 1, 2026, so the all-in cost per seat is considerably higher than the add-on line implies. Model the fully loaded seat, not the 30 USD.
Security Copilot is capacity based. Microsoft describes provisioned capacity as priced per hour and billed monthly with a minimum of one provisioned SCU, and its own billing example uses 4 USD per provisioned SCU and 6 USD per overage SCU. Run a single SCU continuously and you are into four figures a month before any analyst has been trained on it. Microsoft attaches an explicit caveat to those figures, which is worth repeating rather than smoothing over: "Prices are estimates only and are not intended as actual price quotes. Actual pricing may vary depending on the type of agreement entered with Microsoft, date of purchase, the currency exchange rate and taxes."
How much does Microsoft Security Copilot cost?
Microsoft Security Copilot is priced on capacity rather than per seat, so the answer depends on which of three models you fall into. Microsoft's own billing example uses 4 USD per provisioned SCU per hour, and Microsoft states that customers exceeding included capacity can scale beyond it at 6 USD for each SCU on a pay-as-you-go basis. Run a single SCU around the clock and provisioned capacity lands near four figures a month before anyone is trained on it. Figures verified against Microsoft Learn in September 2026.
| Model | Who it applies to | What you pay | Key condition |
|---|---|---|---|
| Microsoft 365 E5 and E7 inclusion | All Microsoft 365 E5 and E7 customers, no minimum license count | No additional cost for the included allowance | 400 SCUs each month for every 1,000 paid user licenses, capped at 10,000 SCUs each month |
| Provisioned capacity | Customers without qualifying E5 or E7 licenses | Billed per hour, minimum one SCU | Capacity refreshes each full clock hour and unused SCUs expire at the end of the hour without rolling over |
| Overage capacity | Any customer exceeding provisioned or included capacity | 6 USD per SCU pay-as-you-go, billed on usage | Billed to one decimal place for exact consumption, not rounded up to whole units. Can be capped or set to unlimited |
The inclusion allowance scales below the thousand-license mark too. Microsoft's published examples are an organization with 400 user licenses getting 160 SCUs per month, and one with 4,000 licenses getting 1,600. Allocations reset monthly and do not roll over.
The billing detail that costs teams money
Provisioned capacity bills in whole clock-hour blocks, not in rolling sixty-minute windows, and this catches people out. Microsoft's own example: provision an SCU at 9:05, deprovision it at 9:35, then provision another at 9:45, and you are charged for two units inside the 9:00 to 10:00 hour. Microsoft's advice is to make provisioning changes at the beginning of the hour. One more operational note worth knowing before you set a tight budget: if provisioned SCUs run out, Security Copilot requests stop unless another capacity type is available.
What license do you need for Copilot for Security?
There is no per-user Security Copilot license to buy. Access comes either bundled with Microsoft 365 E5 or E7, or through capacity you provision in Azure. Microsoft began rolling out E5 and E7 inclusion on November 18, 2025, and eligible tenants are activated automatically with no Azure setup and no manual SCU provisioning, which Microsoft describes as zero click activation.
Three eligibility details matter at renewal. All Microsoft 365 E5 and E7 customers qualify regardless of user count. Microsoft Sentinel customers without E5 or E7 licenses are not eligible. And if you already provisioned capacity before becoming eligible, Microsoft explicitly recommends you do not delete it.
Inclusion also has edges. Microsoft lists items outside the included capacity, including Microsoft Sentinel data lake compute and storage costs, the non-agentic Data Security Investigations experience in Microsoft Purview, Azure Logic Apps charges incurred through Security Copilot, and partner-built agent licensing purchased through Security Store. SCU costs for partner-built agents are included until further notice, but the partner's own license may not be.
Microsoft attaches a caveat to its published figures that is worth repeating rather than smoothing over: "Prices are estimates only and are not intended as actual price quotes. Actual pricing may vary depending on the type of agreement entered with Microsoft, date of purchase, the currency exchange rate and taxes." Confirm against your own agreement before budgeting.
Is Microsoft Security Copilot included in Microsoft 365 E5?
Partly, and this is the detail most worth knowing before a renewal conversation. Microsoft states that "eligible Microsoft 365 E5 and E7 customers will have 400 Security Compute Units (SCUs) per month for every 1000 user licenses, up to 10,000 SCUs per month". That is an included allowance, not unlimited access, and consumption past it is billed separately.
So a 1,000 seat E5 tenant already has a meaningful Security Copilot allocation sitting unused. If your SOC has never switched it on, the cheapest experiment available to you costs nothing extra. Microsoft 365 Copilot has no equivalent inclusion at any suite level. It is always an add-on purchase.
Which one should you buy?
Answer the question the products actually address, not the one the shared name suggests.
| If your goal is | Buy | Why |
|---|---|---|
| Faster drafting, summarizing and meeting recap for staff | Microsoft 365 Copilot | This is the only product of the two that does it, and the value case is time saved per knowledge worker |
| Helping a small SOC triage more incidents | Security Copilot, starting with the E5 allowance | If you hold E5 or E7 the allocation is already paid for. Prove value on included SCUs before provisioning more |
| Reducing the data exposure a Copilot rollout creates | Neither. Buy nothing | The work is permission remediation and Purview labeling, both of which you already own. This is the mistake worth avoiding |
| Finding answers across company systems rather than drafting | Consider a dedicated tool | If the real requirement is retrieval, a purpose-built system for searching across everything your team stores often costs less per seat than a full Copilot rollout |
| Governing what AI agents are allowed to do | Neither, this is a separate control layer | Both Copilots assume the action is authorized. Nothing in either one decides whether an agent should be permitted to take it |
The third row is the one we see most often and it is the reason this article exists. A team rolls out Microsoft 365 Copilot, security raises oversharing concerns, somebody notices Security Copilot in the price list, and capacity gets approved to answer a risk it has no relationship to. Security Copilot will help your analysts investigate an incident faster. It will not stop Copilot surfacing a payroll file to someone who should never have had read access to the site it lives on. That is a permissions problem, and the fix is Microsoft 365 Copilot security work in Purview: oversharing assessments, sensitivity labels with DLP, and Restricted SharePoint Search as a temporary circuit breaker while permissions get repaired.
Does Security Copilot protect Microsoft 365 Copilot?
No. Security Copilot is an analyst assistant. It reasons over signals your security tools already produce, and it has no enforcement role in the Copilot request path. It does not inspect Copilot prompts, does not decide whether Copilot may read a document, and does not sit between Copilot and Microsoft Graph.
The controls that do govern Microsoft 365 Copilot are ordinary Microsoft 365 controls: the permission model, sensitivity labels, Purview DLP policies scoped to the Copilot location, and Restricted SharePoint Search. Microsoft also runs jailbreak and cross-prompt injection classifiers inside its own service, with a caveat it publishes plainly, that those classifiers "may not be available in all Microsoft Copilot scenarios". None of that is affected by whether you own Security Copilot.
What about the other Copilots?
Two more products share the name and neither belongs in this comparison, though both come up in the same procurement conversation.
- GitHub Copilot is a developer tool, licensed per seat through GitHub rather than Microsoft 365. Its security story is about agent mode, the coding agent and Copilot CLI acting on repositories, and GitHub documents its own control gaps unusually plainly. We cover that separately in GitHub Copilot security.
- Copilot Studio is the platform for building custom agents, which is where a Copilot deployment stops answering questions and starts taking actions. That shift is the point at which agent authorization becomes a real requirement. See Copilot Studio security.
- Agent 365 is the newest line item and the one most likely to appear in your next renewal. It is a per-user control plane for the agents themselves, generally available since May 2026 and separate from both Copilot licenses. We break down what it costs and what it covers in Microsoft Agent 365 security, pricing and licensing.
The reason to keep these straight is not pedantry about branding. Each product has a different threat model, and a control that covers one covers none of the others. Enterprise managed settings govern GitHub Copilot and have no bearing on Microsoft 365 Copilot. Purview DLP governs Microsoft 365 Copilot and does not reach a GitHub agent running in CI. Assessments that treat "Copilot" as one system routinely conclude that a control is in place when it applies to a different product entirely.
The question neither product answers
Both Copilots are built on an assumption that holds well for assistants and poorly for agents: that the human in front of the screen is accountable for what happens next. Microsoft 365 Copilot returns a draft and a person decides whether to send it. Security Copilot returns an investigation summary and an analyst decides whether to act. In both cases a human is the control.
That assumption stops holding the moment a Copilot Studio agent, a Graph connector or an MCP-connected tool starts taking actions unattended. At that point the meaningful question is not what the assistant may read, it is what it is permitted to do, and whether there is a record of it having done so. Microsoft is explicit that diligence on third-party agents attached to your tenant is yours to perform: check the privacy statement and terms of use of each agent to determine how it will handle your data. That is a fair position for a platform vendor and a thin control for a regulated business, which is why enterprise agent governance and a single audit record across agents tend to land on the roadmap shortly after the first Copilot Studio agent ships.
If you are still mapping the category, the AI security vendor landscape covers who does what, and AI agent hardening covers the controls that apply once agents act on their own.
See the firewall block an attack live.
Drive the Threat Console and watch a real prompt injection get stopped, then put AgentShield in front of your own agents.