The cybersecurity landscape has never been more demanding. Cyber threats are evolving at an unprecedented pace, posing significant risks to organizations across industries.
Businesses face daily challenges like managing overwhelming alert volumes, securing multi-cloud environments, and addressing increasingly sophisticated attacks. For governance and security professionals tasked with protecting enterprise data, traditional methods simply cannot keep pace with modern threats.
Microsoft announced that Security Copilot agents will be directly built into the flow of work for security teams using Microsoft Defender, Microsoft Entra, Microsoft Intune, and Microsoft Purview. This integration marks a fundamental shift in how organizations approach cybersecurity, moving from reactive to proactive, autonomous defense.
One of the most pressing challenges facing security leaders today is finding qualified professionals to fill critical roles. A widening cybersecurity talent gap, estimated at 3.5 million unfilled cybersecurity jobs globally, compounds the difficulty of safeguarding sensitive data and infrastructure.
Security Copilot directly addresses this workforce crisis by augmenting your existing team with AI-powered capabilities. To make the agents easily accessible and help security teams get started more quickly, Microsoft announced that Security Copilot will be available to all Microsoft 365 E5 customers.
The practical impact is significant. In a randomized trial, Security Copilot reduced security response times by 26%, allowing teams to act faster and mitigate risks more effectively. Analysts using Security Copilot expressed greater confidence in their work, with 86% reporting improved quality and 90% wanting to use it for future tasks.
For governance professionals concerned about operational efficiency, this means your security analysts can accomplish more with existing headcount while maintaining the quality and thoroughness your compliance requirements demand.
Security teams often struggle with alert fatigue and the inability to prioritize the most critical threats. Microsoft has launched twelve new Security Copilot agents in preview in Microsoft Defender, Microsoft Entra, Microsoft Intune, and Microsoft Purview. The company has also introduced over 30 new partner agents that are designed to offer end-to-end protection to organizations.
"These adaptive agents work side by side with security teams to triage incidents, optimize conditional access policies, surface threat intelligence, and maintain secure, compliant endpoints more easily."
- Vasu Jakkal, Corporate Vice President, Microsoft Security
Here's how the agents address specific operational needs:
For SOC Teams: New Microsoft Defender agents automate alert triage, prioritize threat intelligence, enable natural-language threat hunting capabilities, and detect missed threats to close visibility gaps and speed up incident response.
For Identity Teams: Microsoft Entra agents are designed to help identity teams manage risky users, optimize conditional access policies, streamline access reviews, as well as govern application lifecycles.
For Data Security Teams: With Microsoft Purview agents, data security teams can discover and remediate sensitive data exposure, provide contextual risk insights, and enable proactive compliance.
For IT Teams: The new Microsoft Intune agents help IT teams convert requirements into policies, analyze changes before rollout, and detect devices for removal.
Governance professionals often face the challenge of managing disparate security tools that don't communicate effectively. Security Copilot eliminates this problem through deep integration across the Microsoft security ecosystem.
Security Copilot offers an immersive standalone experience and intuitive embedded experiences that are available in other Microsoft security products. This dual approach means security professionals can access AI assistance wherever they work.
Microsoft 365 E5 customers who already have Security Copilot can get started today with: Security operations in Microsoft Defender, Data security in Microsoft Purview, Identity and access in Microsoft Entra, and Endpoint management in Microsoft Intune.
Security Copilot integrates with and embeds within multiple Microsoft security products:
The more of these you have deployed, the more valuable Security Copilot becomes. It can access data from these integrations and provide AI assistance grounded in your actual security telemetry.
For governance and finance teams concerned about predictable costs, Microsoft has structured the Security Copilot inclusion to provide meaningful capacity without surprise expenses.
Eligible Microsoft 365 E5 customers who were notified of their eligibility will automatically receive Security Copilot through zero click activation. Security Copilot is provisioned automatically as part of their subscription. This means no Azure setup is needed or capacity provisioning required. Eligible customers can start using Security Copilot right away.
The capacity allocation works as follows:
Your organization will have access to Security Copilot with 400 security compute units (SCUs)/month for every 1,000 paid users in Microsoft 365 E5 (up to 10,000 SCUs/month across all workspaces). SCU allocation scales based on the number of users in Microsoft 365 E5.
If an organization exceeds this monthly capacity, they will have the option to pay for scaling beyond the allocated amount on a pay-as-you-go basis, priced at an estimated rate of $6 per SCU.
Rollout started on November 18, 2025, for existing Security Copilot customers with Microsoft 365 E5, and will continue in the upcoming months for all Microsoft 365 E5 customers. Customers receive a 30-day advanced notification before activation.
Data security and regulatory compliance remain top priorities for governance professionals. Microsoft Security Copilot is a cloud-based AI platform that can assist security and compliance professionals in protecting their organization's data.
Security and compliance professionals can use Security Copilot to identify, summarize, triage, and remediate issues within the following Microsoft Purview solutions
The embedded experience in Purview delivers practical value for compliance teams:
The embedded experience in Purview can help you get AI-generated summaries from Microsoft Purview product documentation, use suggested or customized prompts in DSPM, learn more about the data security posture in your organization, summarize alerts in DLP, get insights into policies, Security Copilot can help you understand what your policies are doing in your organization and where they're active, and summarize alerts in insider risk management.
Safeguard your organization's information. Depending on your current licensing, use Microsoft Purview and SharePoint Advanced Management to assess oversharing risks.
You can also use Microsoft Purview for policy recommendations and to take corrective actions. These actions help you to be confident that sensitive data remains protected, and access is limited to only those users who need it, including with Copilot and agents.
Welcome to a new era of cybersecurity: where security is ambient and autonomous, with agents built-in, easy-to-use, and ready to empower your team to stay ahead of threats.
For organizations already on Microsoft 365 E5, the transition to Security Copilot is remarkably straightforward. All other Microsoft 365 E5 customers can get access to Security Copilot as part of a phased rollout in the upcoming months, with notifications sent 30 days prior to activation.
Microsoft 365 E5 customers who already have Security Copilot can get started today with core agentic experiences across Microsoft Entra, Microsoft Intune, Microsoft Purview, Microsoft Defender, and the Security Copilot portal, plus developer tools and APIs for custom agents and integrations.
Ready to transform your security operations? Start by reviewing your current Microsoft 365 E5 deployment and identifying which security workloads would benefit most from AI-powered assistance.
Whether it's accelerating incident response, strengthening identity governance, or enhancing data protection compliance, Security Copilot delivers measurable value for governance and security professionals alike.
Join Our Newsletter
