How is Security Copilot licensed for organisations with M365 E5?
The question
The Security Copilot licensing discussion needs to include information about how it is made available to orgs with M365 E5
The answer
Hey Dean — thanks for flagging this, great spot.
I’ve just updated the page with a proper M365 E5 section (give Cloudflare ~2 min to deploy).
Quick answer for the page-update record:
Security Copilot is NOT bundled with M365 E5 — it’s a standalone pay-per-use product at $4 per Security Compute Unit (SCU) per hour.
That said, E5 customers are the natural buyer. Security Copilot’s superpower is reasoning across signals it doesn’t generate itself — and E5 is what provides those signals:
| E5 component | What Security Copilot uses it for |
|---|---|
| Defender XDR (endpoint, email, identity, cloud apps) | Cross-workload incident investigation |
| Entra ID P2 | User risk + conditional access context |
| Purview | Insider risk + DLP correlation |
| Intune | Device compliance signals |
Microsoft Sentinel is the one most people get caught by — Sentinel is NOT in E5, it’s billed separately by GB ingested. You can still use Security Copilot without Sentinel, but cross-source threat hunting gets much weaker.
Microsoft Learn references (added to the page):
Two questions back to you so I can keep improving the page:
- Anything missing? Specifically — would a worked cost example for a specific org size help, or is the table good?
- Anything else you’d like added or clarified on the licensing site? Always happy for more feedback.
Cheers Sush
Hi Dean, I owe you a correction. My earlier answer said Security Copilot was not included with Microsoft 365 E5. That answer was wrong, and the licensing page still repeats it. I’m sorry — you asked about exactly the point I should have checked more carefully.
Microsoft’s Security Copilot inclusion documentation explains availability for eligible Microsoft 365 E5 and E7 customers, including the phased rollout and included capacity. It should not be described as something every E5 customer must always purchase separately.
Please use that Microsoft page rather than my earlier answer for this point. The site correction is still outstanding; I haven’t fixed the published page yet, and I don’t want this reply to suggest otherwise.
Thank you for raising it in the first place.
Sush
Hi Dean, a quick follow-up: the licensing guide now explains the included Security Copilot capacity for eligible Microsoft 365 E5 and E7 customers, rather than describing it only as a separate purchase.
It covers the shared monthly allowance, phased activation, automatic provisioning, and what still has a separate cost. I also corrected the price label and FAQ so they tell the same story.
The details are in the updated Security Copilot guide. Thank you for helping me get this right.
Sush