Microsoft Security Copilot
Pricing Details
Pay-as-you-go. Pricing is based on consumed Security Compute Units (SCUs) per hour.Features
Natural language incident analysis, SOC response automation, Integration with Microsoft Sentinel and Defender, Set of specialized agents, Report and script generationIntegrations
Microsoft Sentinel, Microsoft Defender XDR, Microsoft Intune, Microsoft Purview, Microsoft EntraPreview
Microsoft Security Copilot acts as an indispensable partner for Security Operations Center (SOC) analysts. It provides a unified, natural language interface to interact with the entire Microsoft security product stack. Instead of manually writing complex KQL queries in Microsoft Sentinel or analyzing hundreds of alerts in Defender, an analyst can simply ask Copilot, Show me all incidents related to user X in the last 24 hours and summarize them. Copilot will not only retrieve the data but also analyze it, highlight key points, and suggest response steps. The March 2025 update introduced a set of specialized agents that further automate workflows. For example, the Phishing Triage Agent can autonomously analyze suspicious emails, check links and attachments, and provide a final verdict, saving hours of manual work. This enables even less experienced analysts to perform at a senior level, while experts can focus on the most complex and non-trivial threats.