Microsoft took price off the table for Security Copilot.
👉🏻Security Copilot is getting into E5 licenses from April 20, with no procurement cycle or separate SKU negotiation.
✔ 400 SCUs per month per 1,000 users (capped at 10K SCUs/month)
✔ Agentic workflows built directly into Defender, Entra, Intune, and Purview
✔ Developer APIs open for custom agent builds
The Entra agent for identity triage, the Intune agent for policy gap analysis, and the Purview agents for data risk. These are live in production environments and genuinely reduce analyst toil on repetitive L1/L2 tasks.
That said, a few things I’d say:
✔ You get 7 days’ notice before your tenant is enabled, which is short.
✔ Sentinel storage/compute, Logic Apps usage, and third-party store agents are NOT included. Budget accordingly.
The tool is landing in your environment whether you’re ready or not. The strategy still needs to come from you.