It’s rare for a Microsoft Ignite announcement to affect daily security work this directly. Security Copilot E5 will soon be bundled into Microsoft 365 E5 subscriptions. In many of the organizations I work with, Security Copilot was discussed for a long time as an expensive add-on, and SCU (Security Compute Unit) quotas made budgeting complicated. Microsoft’s 2025 Ignite news now confirms that E5 customers will receive a monthly SCU allowance that scales with licence count. The fine print on SCU volume and consumption monitoring is still to come, but the basic model is set. Below I go through what this changes for security teams and where I would put your attention next.

Security Copilot E5 already shows up across the Microsoft security stack

Security Copilot is no longer just a standalone portal or a premium pilot for very large SOCs. It already appears natively in Defender XDR, in Entra ID (mainly in Identity Governance and incident investigation), in Intune for endpoint management and in Microsoft Purview for compliance and insider risk. The part I find most interesting is the set of Security Copilot agents, the pre-built, scenario-focused bots Microsoft announced back in March. Admins and analysts often discover them by accident, when an “Enable Copilot” button appears on an incident or a chat panel shows up inside a dashboard they use every day. I looked at what these agents automate and how much they help in practice in Security Copilot agents: Automation meets admin reality.

The diagram below gives a high-level picture of how the E5-linked SCU credits make Copilot features available across Microsoft’s security products:

flowchart TD
  E5["Microsoft 365 E5 licence"] --> SCU["Monthly SCU allowance"]
  SCU --> DefXDR["Defender XDR (Copilot)"]
  SCU --> Entra["Entra ID (Copilot)"]
  SCU --> Intune["Intune (Copilot)"]
  SCU --> Purview["Purview (Copilot)"]
  DefXDR --> Agent["Security Copilot agents"]
  Entra --> Agent
  Intune --> Agent
  Purview --> Agent

Figure: Security Copilot E5 – where your monthly SCU credits feed Copilot experiences across the stack.

The E5 model makes Copilot roles and their assignment more important

The Copilot-specific roles add another layer to manage, though they also give you more control. The Security Copilot owner and contributor roles decide who can open the portal, and also who can configure agents, activate plugins and connect data sources. In practice I still see these assignments handled loosely. Sometimes a couple of global admins hold them, sometimes they are handed out far too broadly across the security team. This tip has saved me a fair amount of trouble:

Assign Security Copilot owner and contributor roles carefully, document who holds them, and audit regularly. Otherwise plugin sprawl and privilege creep will catch up with you before you notice.

You manage these roles in the Microsoft Defender portal under Settings → Roles. If you already use Entra Privileged Identity Management, I’d set up a similar review process here (see also Privileged Identity Management in Entra ID: Moving from Standing Admin Rights to Just-in-Time Access – Lessons from the Field).

Usage, SCU and plugin monitoring needs much closer attention now

Once Copilot comes with E5, keeping an eye on SCU quotas and plugin usage matters a lot more. Microsoft now offers a central dashboard in the Defender portal where you can track current SCU consumption, usage trends and forecasted needs. That makes it easier to spot unexpected spikes or to plan ahead for periods of heavy analysis. Plugins, particularly the ones that connect to a SIEM or third-party sources, can extend Copilot’s reach considerably, but they also add complexity and drive up consumption. Before I enable a new plugin, I always review the user assignments and check the data flow. You’ll find details and guides in the official documentation and on the getting started pages.

For a quick look at usage, go to Defender portal → Settings → Security Copilot → Usage. There you get interactive consumption reports (owner or contributor role required).

Analysts still have to verify Copilot output and need training for it

The biggest change in culture concerns how analysts treat what Copilot produces. Security Copilot is powerful, but it makes mistakes. Summaries, playbooks and incident recommendations still need an analyst to review and validate them. Where Copilot touches sensitive data, such as compromised Entra ID users or Purview email flows, I advise checking the results again before anyone acts on them. Teams should learn to question Copilot’s output and, where needed, confirm it with their own queries, for example with “Advanced Hunting” in Defender XDR. For authentication and access controls, see Security Copilot Authentication.

Security Copilot E5 could well become the new normal for security teams

Putting Security Copilot into E5 will change how most security teams work. It becomes part of the standard toolkit instead of an add-on for a select few, and I expect it to be as common as Defender XDR or Purview before long. Whether it works out depends on careful role assignment, governance and training. If you let Copilot run unchecked, you end up with plugin chaos, SCU overages or analysts accepting AI suggestions without thinking. I’m curious which use cases will stick and whether Copilot turns into the everyday tool of the modern SOC. I covered the GA phase and SCU licensing in an earlier post: Copilot for Security: What GA and SCU pricing really mean.