Security Copilot, a dial someone has to own
Security Copilot is priced on Security Compute Units provisioned by the hour, not on a per user license: the bill is set by how many SCUs you keep live, not how often analysts use it, and capacity left running overnight and across weekends costs the same as capacity in active use. Buyers who sized it on headcount, the way they size Microsoft 365 Copilot, watched the bill detach from usage immediately.
Prepared by Redress Compliance · August 7, 2026 · Microsoft security advisory. Based on 12 to 18 Security Copilot evaluations run or reviewed 2024 to 2025.
Executive summary
The unit is provisioned time, and the waste is the quiet hours. One SCU lists near $4 per hour, roughly $2,920 a month always on, and initial provisioning ran 40 to 70 percent above what steady state usage justified, because teams left capacity live overnight and across weekends.
Both the standalone portal and the features embedded in Defender meter against the same SCU pool, and the classic mistake is provisioning for the worst incident of the quarter and holding that capacity at three in the morning on a quiet Sunday.
The schedule is the saving. Capacity is adjustable through the day and on a schedule, so flat provisioning is a choice: scheduling SCUs to the security operations shift cut bills 30 to 50 percent with no loss of analyst coverage.
Three SCUs always on run about $8,760 a month; the same three for business hours only run about $3,120; and a burst to ten SCUs for a twelve hour incident costs about $480, which is the arithmetic that makes the dial worth owning.
The data line stacks on top, and it surprised finance. Security Copilot has no value without the Defender and Sentinel signal it reasons over, and the ingestion added 20 to 35 percent on top of the SCU line in estates that had not already paid for it.
The high value plays depend on connected data, so the SCU line and the data line budget together or the total arrives in two unpleasant halves.
The sizing runs on concurrency, not headcount.
Most security operations teams start well with one to three SCUs, and three factors set the floor: how many analysts run it at the same moment, not team size; the weight of each task, an incident summary across many alerts against a single prompt.
And the automation share, since logic apps and scheduled jobs draw the same pool.
Start at one, measure real consumption, and let the evidence raise it.
The provisioning patterns, priced
| Provisioning pattern | SCUs live | Hours per month | Approximate monthly list |
|---|---|---|---|
| One SCU, always on | 1 | 730 | $2,920 |
| Three SCUs, always on | 3 | 730 | $8,760 |
| Three SCUs, business hours only | 3 | About 260 | About $3,120 |
| A burst to ten SCUs for an incident | 10 for 12 hours | 12 | About $480 |
The table is the argument. The always on triple costs nearly three times the business hours triple for identical daytime coverage, and the incident burst that justified the peak sizing costs a few hundred dollars when bought as a burst instead of a standing commitment.
The bill is driven by provisioned capacity over time, not by analyst logins or prompt counts, which is the single most important fact a buyer needs.
The sizing, on the three factors that set the floor
- Concurrency: the number of analysts running Security Copilot at the same moment, which is a fraction of the team size the headcount model prices.
- Task weight: a full incident summary across many alerts consumes multiples of a single prompt, so the workload mix, not the average, sizes the peak.
- The automation share: logic apps and scheduled jobs calling Security Copilot draw the same SCU pool, on timers, whether anyone watches.
- The starting posture: one SCU, real consumption measured, capacity raised on evidence and scheduled to the shift, with the burst reserved for incidents.
The Microsoft EA renewal playbook
The security consumption lines inside the agreement: the SCU dial, the data ingestion interplay, and the caps worked on a representative estate.
Get the white paper →The stack underneath, where the value and the cost both live
Security Copilot reasons over the data already in the estate, so its value tracks the signal quality: the high value plays sit on Microsoft Defender and Sentinel, and without that connection it answers general questions at enterprise prices.
The cost consequence is the stacked budget: Sentinel ingestion bills separately by volume, added 20 to 35 percent on top of the SCU line where not already funded, and the ingestion discipline, the filtering, the tiering, and the unclaimed E5 grant, is its own money.
Worked in the Sentinel optimization guide.
The endpoint side entitlements feeding the same signal run through the Defender P1 versus P2 analysis, and the seat based Copilot economics next door, a different model entirely, in the Copilot licensing guide.
- Percentile standing for your exact deal size and industry, from real closed transactions
- Scenario simulation before the call: test alternative terms and see the financial impact of each
- A negotiation playbook, talking points, and a two page executive brief on day one
What we saw across evaluations, 2024 to 2025
Across roughly 12 to 18 Microsoft Security Copilot evaluations run or reviewed between 2024 and 2025, buyers sized the deployment on headcount and watched the bill detach from usage:
Above steady state, from capacity left live overnight and across weekends with no owner.
Cut from the SCU bill by matching capacity to the shift, with no coverage lost.
The framing that survived every evaluation: the real cost was never the headline SCU rate, it was the always on provisioning nobody owned plus the Sentinel ingestion the tool quietly pulled forward, and the correction is organizational before it is technical.
The SCU number is a dial, a named owner adjusts it to the shift pattern, the burst covers the incidents the peak sizing was bought for, and the data cost models in the same business case, so finance sees one number instead of two surprises.
Your first five moves
- Start at one SCU and measure, because concurrency and task weight, not headcount, set the real floor.
- Schedule capacity to the security operations shift, where the 30 to 50 percent lives, and buy incidents as bursts.
- Name the dial owner, since always on provisioning nobody owns is where the 40 to 70 percent excess came from.
- Budget the Sentinel ingestion with the SCU line, the 20 to 35 percent that otherwise surprises finance separately.
- Count the automation draw, logic apps and scheduled jobs on the same pool, in every forecast. The Microsoft practice runs the model with you.
Frequently asked questions
How is Microsoft Security Copilot priced?
On consumption: you provision Security Compute Units and Microsoft bills the capacity you keep live by the hour, near $4 per SCU per hour at list, roughly $2,920 per SCU per month always on.
There is no per user license, both the standalone portal and the Defender embedded features meter the same pool, and the bill follows provisioned time, not analyst activity.
How many Security Compute Units do we need?
Most security operations teams start well with one to three: the floor is set by concurrency, how many analysts run it simultaneously rather than team size, task weight, and the automation share drawing the same pool.
Start at one, measure real consumption, raise on evidence, and reserve the peak for scheduled bursts during incidents.
What is the biggest Security Copilot cost mistake?
Flat provisioning: initial deployments ran 40 to 70 percent above steady state because capacity stayed live overnight and across weekends, sized for the worst incident of the quarter and held every hour since.
Scheduling SCUs to the operations shift cut bills 30 to 50 percent with no coverage loss, and a twelve hour ten SCU incident burst costs about $480.
Does Security Copilot require Defender and Sentinel?
For the high value plays, effectively yes: it reasons over the data already in the estate, and without the Defender signal and Sentinel ingestion it answers general questions at enterprise prices.
The ingestion bills separately by volume and added 20 to 35 percent on top of the SCU line where not already funded, so the two lines budget together.
Can Security Copilot capacity be scaled down?
Yes, and that is the whole model: the SCU count adjusts through the day or on a schedule in the portal, so flat provisioning is a choice rather than a constraint.
The buyer posture treats the number as a dial with a named owner, matched to the shift pattern, raised for incidents as bursts, and reviewed against measured consumption monthly.
How does Security Copilot pricing differ from Microsoft 365 Copilot?
Completely: Microsoft 365 Copilot licenses per user per month on seats, while Security Copilot bills provisioned compute by the hour with no user dimension at all.
Sizing it on headcount, the instinct the seat product trains, is exactly the mistake that detached bills from usage in our evaluations, because the meter never counted analysts.
Negotiating Microsoft E5, E7, and Copilot Cowork: The Two-Layer Bill
E7 at $99 vs $117 in components, and the truth proposals omit: $99 is the governance floor. Agent execution bills separately through Copilot Credits with no rollover, Security Copilot overages at $6 per unit, and Cowork priced as license plus meter.
