As cybersecurity threats grow more sophisticated, the tools used to defend against them must evolve to be faster, smarter, and seamlessly integrated into daily workflows. At Ignite 2025, Microsoft announced a monumental shift in how organizations will access generative AI for security: Security Copilot is now included at no additional cost for all Microsoft 365 E5 and E7 customers.

This update moves Security Copilot from a standalone, consumption-billed add-on to an ambient, built-in capability. Here is a comprehensive overview of how the new inclusion model works, how capacity is allocated, and what to expect during the rollout.

1. Zero-Click Activation and Auto-Provisioning

Historically, setting up Security Copilot required linking an Azure subscription and manually provisioning Security Compute Units (SCUs) on an hourly basis. The new inclusion model completely eliminates this friction for eligible E5 and E7 customers.

Through zero-click activation, Security Copilot is provisioned automatically as part of your existing subscription. There is no Azure setup needed, and capacity is configured for you in the background. As the rollout hits your tenant, Microsoft handles the creation of a default workspace, sets the prompt evaluation locations, and establishes default data sharing preferences (which administrators can easily adjust later).

2. Understanding the Inclusion Capacity Model

Under the previous paid model, organizations provisioned SCUs hourly, meaning they were billed for capacity whether they actively used the AI during that hour or not.

The inclusion model introduces a much more flexible, usage-based approach tied to your license count:

Monthly SCU Allocation: Microsoft provides a baseline of 400 SCUs per 1,000 user licenses every month. This amount scales directly with your user count (e.g., an organization with 4,000 licenses receives 1,600 SCUs monthly). This allocation applies even to organizations with fewer than 1,000 licenses.

Consumption-Based: Instead of an hourly burn rate, SCUs are only deducted from your monthly allocation when Security Copilot is actively used (e.g., running an embedded experience, using the standalone portal, or invoking agents).

Monthly Reset: It is important to note that SCU allocations reset at the beginning of each month and do not roll over.

3. Deep Integration Across the Security Portfolio

The true power of this inclusion is that it places “agentic AI” directly into the tools your security, compliance, and IT teams are already using. Security Copilot agents are now natively embedded into:

Microsoft Defender: Automating routine triage, investigating incidents, and shifting teams from reactive response to proactive threat hunting.

Microsoft Entra: Providing AI-assisted identity management, such as analyzing access reviews and troubleshooting sign-ins using natural language.

Microsoft Purview: Enhancing data security and compliance tracking.

Microsoft Intune: Allowing endpoint administrators to extract device insights, monitor tenant health, and take action without leaving the Intune admin center.

4. Rollout and Next Steps

The rollout for this inclusion began on November 18, 2025, starting with existing Microsoft 365 E5 customers, and is continuing to deploy across all E5 and E7 tenants globally.

How do you know if you have access?

Administrators will receive a 30-day (or 7-day for some existing setups) advanced notification in the Microsoft 365 admin center before activation. Once active, you will see in-product banners directly within Defender, Purview, Entra, Intune, or the standalone Security Copilot portal indicating that the features are ready to use.

By removing the cost barrier and operational friction, Microsoft is democratizing access to top-tier security AI. For E5 and E7 customers, this inclusion means your security operations are about to get significantly faster, smarter, and more proactive.

For detailed guidance on adjusting your auto-provisioned workspace settings, managing RBAC roles, and monitoring your SCU usage, visit the official Security Copilot inclusion documentation on Microsoft Learn.

To get more such useful information, please follow our LinkedIn page and you can also subscribe our you tube page.

YouTube Link: https://www.youtube.com/@bizcentralorbit

LinkedIn Link: https://www.linkedin.com/company/bizcentralorbit/posts/?feedView=all

If you want more updates and daily Blogs like “Can We Delete Posted Documents in Business Central?” click the link: https://bizcentralorbit.com/can-we-delete-posted-documents-in-business-central/

If you want more Demo and Tutorial videos like “How to create Special Order in Business Central” on Youtube click the link: https://www.youtube.com/watch?v=qFj_ECsOVrY

Raise a support ticket instantly by clicking the link: https://bizcentralorbit.com/contact-us/

Want to analyze any requirement and collaborate? Let’s work together to deliver the best solution! Please submit the details here: https://bizcentralorbit.com/bc-consultants/