How is Security Copilot licensed for organisations with M365 E5?
The question
The Security Copilot licensing discussion needs to include information about how it is made available to orgs with M365 E5
The answer
Hey Dean — thanks for flagging this, great spot.
I’ve just updated the page with a proper M365 E5 section (give Cloudflare ~2 min to deploy).
Quick answer for the page-update record:
Security Copilot is NOT bundled with M365 E5 — it’s a standalone pay-per-use product at $4 per Security Compute Unit (SCU) per hour.
That said, E5 customers are the natural buyer. Security Copilot’s superpower is reasoning across signals it doesn’t generate itself — and E5 is what provides those signals:
| E5 component | What Security Copilot uses it for |
|---|---|
| Defender XDR (endpoint, email, identity, cloud apps) | Cross-workload incident investigation |
| Entra ID P2 | User risk + conditional access context |
| Purview | Insider risk + DLP correlation |
| Intune | Device compliance signals |
Microsoft Sentinel is the one most people get caught by — Sentinel is NOT in E5, it’s billed separately by GB ingested. You can still use Security Copilot without Sentinel, but cross-source threat hunting gets much weaker.
Microsoft Learn references (added to the page):
Two questions back to you so I can keep improving the page:
- Anything missing? Specifically — would a worked cost example for a specific org size help, or is the table good?
- Anything else you’d like added or clarified on the licensing site? Always happy for more feedback.
Cheers Sush