MC1187672 – M365 Change Digest

One-line summary

Security Copilot with new AI agents is now included at no extra cost for Microsoft 365 E5 customers, rolling out over the coming months across Defender, Entra, Intune, and Purview.

Similar updates

Details

Summary

Microsoft Security Copilot is now included at no extra cost in Microsoft 365 E5, providing integrated AI-driven security agents across Defender, Entra, Intune, and Purview. Customers receive monthly Security Compute Units based on user count, with phased rollout and admin controls via Entra ID group membership.

Body (from Message Center)

Introduction:

Microsoft Security Copilot agents are directly built into the flow of work for security teams in Microsoft Defender, Microsoft Entra, Microsoft Intune and Microsoft Purview. Today, we are introducing a dozen new agents across these products, to bring agentic defense across workflows, enabling adaptive protection.

To make the agents easily accessible and help security teams get started more quickly, we are excited to announce that Security Copilot will be included in your Microsoft 365 E5 plan as part of your core entitlement with no additional cost*. No provisioning or licensing changes are required. Rollout starts today with existing Security Copilot customers with Microsoft 365 E5 and will continue for all Microsoft 365 E5 customers in the upcoming months.

When this will happen

Microsoft 365 E5 customers who already have Security Copilot can get started today with this entitlement.
All other Microsoft 365 E5 customers can get access to Security Copilot as part of a phased rollout in the upcoming months, with notifications sent 30 days prior to activation.

How this affects your organization

Your organization will have access to Security Copilot with:

400 security compute units (SCUs)/month for every 1,000 paid users in Microsoft 365 E5 (up to 10,000 SCUs/month across all workspaces). SCU allocation scales based on the number of users in Microsoft 365 E5.
Core agentic experiences across Microsoft Entra, Microsoft Intune, Microsoft Purview, Microsoft Defender, and the Security Copilot portal
Developer tools and APIs for custom agents and integrations

What you can do to prepare:

Microsoft 365 E5 customers who already have Security Copilot can get started today with:

Security operations in Microsoft Defender: https://security.microsoft.com
Data security in Microsoft Purview: https://purview.microsoft.com
Identity and access in Microsoft Entra: https://entra.microsoft.com
Endpoint management in Microsoft Intune: https://intune.microsoft.com
Review the documentation for details of what’s included with Security Copilot in Microsoft 365 E5

All other Microsoft 365 E5 customers are encouraged to:

Review the documentation for details of what’s included with Security Copilot in Microsoft 365 E5
Explore supported use cases in the Security Copilot Adoption Hub
Watch for the notification email 30 days prior to activation

*Eligible Microsoft 365 E5 customers will have 400 Security Compute Units (SCUs) per month for every 1,000 user licenses, up to 10,000 SCUs per month. This included capacity is expected to support typical scenarios. Customers will have the option to pay for scaling beyond the allocated amount at a future date at a rate of $6 per SCU on a pay-as-you-go basis. They will receive a 30-day advance notice when this option becomes available. Learn more: Learn about Security Copilot inclusion in Microsoft 365 E5 subscription | Security Copilot | Microsoft Learn

Question	Answer
Does the change introduce or significantly modify AI/ML or agent capabilities that interact with or provide access to customer data?	Yes. This change introduces agentic AI capabilities through Security Copilot, which interacts with customer data across Microsoft Defender, Microsoft Entra, Microsoft Intune, Microsoft Purview, and the Security Copilot portal.
Does the change provide users any new way of interacting with generative AI?	Yes. Users will be able to interact with generative AI experiences embedded in Microsoft security tools, including Defender, Entra, Intune, Purview, and the Security Copilot portal.
Does the change include an admin control and, can it be controlled through Entra ID group membership?	Yes. Admins can manage access to Security Copilot and its capabilities using existing Microsoft 365 and Entra ID group membership controls.

Raw JSON (for debugging)

Expand/collapse the full payload below.

Show/hide raw

{
  "snapshot_item": {
    "action_required_by": null,
    "ai_action_required_by": null,
    "ai_actions": [
      "Review Security Copilot documentation",
      "Monitor for activation notification email",
      "Explore use cases in Security Copilot Adoption Hub"
    ],
    "ai_master_tags": [
      "Security"
    ],
    "ai_model": "gpt-4.1",
    "ai_summary": "Security Copilot with new AI agents is now included at no extra cost for Microsoft 365 E5 customers, rolling out over the coming months across Defender, Entra, Intune, and Purview.",
    "ai_topics": [
      "Entra",
      "Intune",
      "Defender",
      "Purview",
      "Copilot"
    ],
    "category": "stayInformed",
    "details_map": {
      "Summary": "Microsoft Security Copilot is now included at no extra cost in Microsoft 365 E5, providing integrated AI-driven security agents across Defender, Entra, Intune, and Purview. Customers receive monthly Security Compute Units based on user count, with phased rollout and admin controls via Entra ID group membership."
    },
    "id": "MC1187672",
    "importance": 1,
    "is_major_change": false,
    "last_modified": "2025-11-18T16:12:36Z",
    "ms_products": [
      "Entra",
      "Intune",
      "Defender",
      "Purview"
    ],
    "platforms": null,
    "roadmap_ids": [],
    "services": [
      "Microsoft Entra",
      "Microsoft Intune",
      "Microsoft Defender XDR",
      "Microsoft Purview"
    ],
    "severity": "normal",
    "tags": [
      "New feature",
      "User impact",
      "Admin impact"
    ],
    "title": "Get ready for security agents: Microsoft Security Copilot will be included in Microsoft 365 E5"
  }
}