Effective January 1, 2026, Microsoft Security Copilot is now included with Microsoft 365 E5. Microsoft has updated its Product Terms to reflect that all Microsoft 365 E5 subscribers gain access to Microsoft Security Copilot, with a monthly allocation of Security Compute Units (SCUs) included as part of the subscription. In practical terms, this means organizations with an E5 license can use Security Copilot’s AI-powered security features at no extra licensing cost under their existing Microsoft 365 E5 agreements. This inclusion is designed to make advanced, AI-driven security capabilities more readily available and easier to adopt for Microsoft 365 E5 customers.
What is Microsoft Security Copilot?
Microsoft Security Copilot is a generative AI-powered security assistant. It helps cybersecurity teams detect, analyze, and respond to threats faster by combining a specialized large language model with Microsoft’s extensive security expertise and threat intelligence. In practice, Security Copilot integrates with Microsoft’s security ecosystem – for example, it works alongside tools like Microsoft Defender, Entra, Intune, and Purview – to gather signals and provide insights within the flow of everyday security workflows. Security analysts can interact with Copilot in plain English, asking questions or requesting summaries of incidents, and the tool will generate useful, contextual answers or recommendations. By leveraging Microsoft’s global threat intelligence, Security Copilot can offer up-to-date insights on emerging threats and help assess an organization’s security posture quickly. In short, it acts as an AI copilot for security professionals, assisting with everything from incident investigation to proactive threat hunting, in an easy-to-use conversational interface.
Licensing
Under the new licensing terms, Microsoft 365 E5 now includes Security Copilot as a built-in entitlement. E5 customers do not need to purchase a separate license or add-on for Security Copilot – it’s part of the E5 package effective Jan 1, 2026. Along with the service itself, Microsoft provides a base amount of usage capacity in the form of Security Compute Units (SCUs) each month as part of Microsoft 365 E5:
- Included SCU Allocation: Every organization with Microsoft 365 E5 receives a monthly pool of SCUs to cover Security Copilot’s workload. The allocation is scaled to the tenant’s user count. Microsoft provides 400 SCUs per month for every 1,000 E5 users (pro-rated for different numbers of users), up to a maximum of 10,000 SCUs per month included at no additional cost. For example, a company with 500 E5 users would get 200 SCUs per month, while one with 5,000 users would get 2,000 SCUs per month, from Microsoft. This included capacity is designed to support common usage scenarios of Security Copilot for most organizations.
- What is an SCU: A Security Compute Unit (SCU) is a unit of cloud compute resource for Security Copilot. It represents the amount of AI processing power needed to run Copilot tasks. In practical terms, consuming one SCU could correspond to roughly a certain number of AI prompts or analyses. Microsoft has indicated roughly ~10 workflows per day per SCU as a rough metric, though actual usage will vary. SCUs are the basis of Security Copilot’s consumption model – previously, customers had to buy SCUs to use Copilot. Now Microsoft 365 E5 includes a chunk of SCUs so you can use Copilot without worrying about immediate charges. If you stay within the included monthly SCU pool, there’s no extra cost.
- SCU Usage and Overage: The included SCU pool resets each month – unused units do not roll over to the next month. If an organization’s usage exceeds the monthly included SCUs, additional SCUs would require a separate purchase (i.e., moving into a paid consumption model for the overage). However, the generous included amounts (e.g. 400 per 1,000 users) aim to cover typical needs. This change to an included model gives E5 customers more predictable costs and the freedom to experiment with Security Copilot’s capabilities without incurring surprise fees. Organizations not on E5 can still access Security Copilot, but they would continue with the original consumption-based licensing model purchasing the needed SCUs separately.
Next steps
SCHNEIDER IT MANAGEMENT’s licensing experts recommend reviewing your current Microsoft 365 licensing to understand the impact of this inclusion. Since Security Copilot is now an entitlement in E5, you should ensure your licenses are correctly provisioned to take advantage of it. The included SCU capacity should cover most use cases.
More Information
For more details about this update, you can refer to the official Microsoft sources:
- Microsoft Product Terms – January 2026 edition (see the “Microsoft 365” section for the clause on Security Copilot inclusion). Original text: “Security Copilot is now included with Microsoft 365 E5. A clause was added to specify the Microsoft 365 E5 subscription provides access to Security Copilot, along with a monthly allocation of Security Compute Units.” (Source: Microsoft Product Terms, Jan 1, 2026) – available at https://www.microsoft.com/licensing/terms (select Product Terms for January 2026).
- Microsoft documentation – “Learn about Security Copilot inclusion in Microsoft 365 E5”. This Microsoft Learn article provides an overview of the rollout timeline, licensing specifics, and FAQs about Security Copilot being added to E5 (e.g. how the SCU allocation scales, eligibility, etc.). It’s a helpful resource for understanding the practical implications. (Source: Microsoft Learn, Security Copilot inclusion in M365 E5) – https://learn.microsoft.com/en-us/copilot/security/security-copilot-inclusion
For our Microsoft page, please visit: https://www.schneider.im/software/microsoft.
Please contact us for expert services on your specific Microsoft software and online services requirements and to request a quote today.
