Microsoft / Security Copilot
Microsoft Security Copilot pricing guide.
Microsoft Security Copilot is priced on Security Compute Units provisioned by the hour, not on a per user license. Read the cost model before you size the deployment.
Microsoft Security Copilot is priced on Security Compute Units provisioned by the hour, not on a per user license. Read the cost model before you size the deployment.
Microsoft Security Copilot is priced on Security Compute Units, provisioned by the hour, not on a per user license. This guide covers the SCU model, the sizing math, the Defender and Sentinel prerequisites, and the buyer side moves that keep the cost in check.
Security Copilot is priced on consumption, not on a named user license. You provision Security Compute Units and Microsoft bills for the capacity you keep live, measured by the hour.
This is the single most important fact for a buyer. The cost is driven by provisioned capacity over time, not by how many analysts log in or how many prompts they run.
A Security Compute Unit, or SCU, is the unit of compute that powers every Security Copilot task. Microsoft meters both the standalone portal and the features embedded in Microsoft Defender against the same SCU pool.
One SCU is the baseline. You provision more to raise throughput and lower the chance of a capacity limit during a busy investigation.
You set a number of provisioned SCUs in the Security Copilot portal. Microsoft bills that capacity per hour until you change it. You can raise or lower the number through the day, or on a schedule.
Because billing is hourly, capacity left live overnight and across the weekend costs the same as capacity in active use during the day. That is where most of the waste sits.
List price sits near 4 dollars per SCU per hour. Run one SCU continuously and the monthly figure lands near 2,920 dollars, because there are roughly 730 hours in a month.
Security Copilot monthly cost by provisioning pattern
| Provisioning pattern | SCUs live | Hours per month | Approx monthly list cost |
|---|---|---|---|
| One SCU, always on | 1 | 730 | 2,920 dollars |
| Three SCUs, always on | 3 | 730 | 8,760 dollars |
| Three SCUs, business hours only | 3 | about 260 | about 3,120 dollars |
| Burst to ten SCUs for an incident | 10 for 12 hours | 12 | about 480 dollars |
Most security operations teams start well with one to three SCUs. The right number depends on how many analysts run Security Copilot at the same time and how heavy each task is.
Three factors set the floor. Concurrency, the weight of each task, and the share of work that runs unattended through automation.
The classic mistake is to provision for the worst incident of the quarter and then leave that capacity live every hour of every day.
A team that needs ten SCUs during a major incident does not need ten SCUs at three in the morning on a quiet Sunday. Capacity is adjustable, so flat provisioning is a choice, not a constraint.
Security Copilot does not replace your security stack. It reasons over the data already in it, so its value tracks the quality of that data.
Security Copilot reaches its potential when it sits on top of Microsoft Defender and Microsoft Sentinel. Without that signal it can still answer general questions, but the high value plays depend on connected data.
The deepest Security Copilot use cases lean on Microsoft Sentinel ingestion and analytics. That ingestion is billed separately by volume. Budget the SCU line and the data line together, or the total will surprise finance.
The standard pitch is that Security Copilot is cheap because one SCU looks small next to an enterprise security budget. We disagree. In most of the evaluations we have reviewed, the real cost was not the headline SCU rate. It was the always on provisioning that nobody owned, plus the Sentinel ingestion the tool quietly pulled forward. The buyer side move is to treat the SCU number as a dial that a named owner adjusts to the shift pattern, and to model the data cost in the same business case. Run it flat and unowned and the bill compounds quietly every single hour.
Source: Redress Compliance advisory engagement file, 2024 to 2025.
Security Copilot is not billed by the prompt. It is billed by the hour you leave it switched on. The cheapest deployment is the one with an owner watching the dial.
Four moves keep Security Copilot spend tied to value rather than to the clock.
Begin with a single SCU and a narrow set of use cases. Prove value before you raise capacity.
Match provisioned SCUs to the security operations shift pattern. Scale down outside core hours and burst only for live incidents.
Use the usage monitoring in the portal to track consumption against provisioning. Adjust monthly. Treat the gap between the two as recoverable budget.
Model Sentinel ingestion and Defender coverage in the same business case as the SCUs. The data cost is part of the true cost of the tool.
No. Security Copilot is billed on Security Compute Units provisioned by the hour, not on a named user license. The cost tracks live capacity over time.
List price sits near 4 dollars per SCU per hour. One SCU running continuously costs roughly 2,920 dollars per month.
Yes. You can raise or lower provisioned SCUs at any time, including on a schedule. Capacity left live overnight bills the same as capacity in active use.
Not strictly, but the highest value use cases reason over Sentinel and Defender data. Without connected data the tool answers only general questions.
Most security operations teams start with one to three SCUs. The right number depends on analyst concurrency and task weight, not total headcount.
No. Sentinel ingestion is billed separately by volume. Budget the data line and the SCU line together to see the true cost.
Provision for the worst incident and leave that capacity live every hour. Flat always on provisioning is the most common source of waste.
No. Redress Compliance is 100 percent buyer side and independent. We advise on the Microsoft negotiation and never resell Microsoft products.
Microsoft renewal moves, the EA framework, the M365 SKU framework, the Copilot framework, and the buyer side moves across the full Microsoft estate.
Used across more than five hundred enterprise engagements. Independent. Buyer side. Built for procurement leaders running the next renewal cycle.
Security Copilot is not the line you negotiate hardest. It is the line you watch every hour. The dial is the deal.
