FAQ
Security Copilot SCU pricing — frequently asked questions
- What is a Security Compute Unit (SCU)?
- A Security Compute Unit (SCU) is a unit of compute capacity Microsoft uses to meter Security Copilot consumption. In provisioned mode you commit to N SCUs per hour at a flat rate; in E5/E7 inclusion and overage modes, SCUs are deducted per consumed operation at one-decimal precision. Microsoft does not publish per-operation SCU rates; the figures of 3 SCU per prompt, 0.5 SCU per incident summary, and 3.7 SCU per promptbook appear in Microsoft Learn's billing-math examples as teaching scenarios, not benchmarks. Real consumption depends on operation complexity and is only visible in your tenant's usage dashboard.
- How do I calculate SCU cost for Microsoft Security Copilot?
- To calculate Security Copilot SCU cost: (1) determine your included pool — paid Microsoft 365 E5 and E7 tenants get 0.4 SCU per license per month, capped at 10,000 SCU/month; (2) estimate monthly consumption by summing chat-administrator usage (admins × messages per workday × ~3 SCU per prompt × 22 working days) and per-agent runs (run count × documented or estimated SCU per run); (3) subtract the included pool from total consumption, then multiply any remainder by $6 USD per SCU for overage, or commit to N SCUs at $4 USD per SCU per hour for provisioned capacity. This calculator runs that math automatically — pick a license profile, enter admin workload, select agents, and the monthly cost appears instantly.
- Are SCUs included with Microsoft 365 E5?
- Yes. Microsoft began auto-provisioning SCUs to paid Microsoft 365 E5 and E7 subscriptions in November 2025, with global rollout completing by mid-2026. The included pool is 0.4 SCU per paid E5/E7 license per month, capped at 10,000 SCU/month — the cap is reached at exactly 25,000 paid licenses. Microsoft's documentation phrases the same rate as 400 SCUs per 1,000 paid licenses; both produce identical math. A tenant with 5,000 paid E5 users therefore receives 2,000 included SCU per month.
- Are SCUs included with Microsoft 365 E3?
- No. Microsoft has only announced auto-included SCUs for Microsoft 365 E5 and E7. E3 subscriptions receive no included SCU and consumption is fully billable at the published overage rate.
- What is the SCU overage rate?
- Microsoft documents an overage rate of $6 USD per SCU on a pay-as-you-go basis once the included pool is exhausted and overage is enabled for the tenant. Overage is billed at one-decimal precision per consumed SCU — not rounded up to whole units.
- What does a provisioned SCU cost per hour?
- Microsoft's pricing examples use $4 USD per provisioned SCU per hour. A single provisioned SCU running 24/7 costs roughly $2,920 per month — billed flat, regardless of how much capacity you actually consume that hour. E5/E7 inclusion is a separate model with no hourly billing; the two don't stack.
- How many SCU does the Phishing Triage Agent consume?
- Microsoft has not published a per-run rate for the Phishing Triage Agent. Field reports from Microsoft product teams put it around 0.5 SCU per email triaged — the same as the incident-summarisation reference in Microsoft's billing-math example. This calculator uses 0.5 SCU as the default; verify against your tenant's usage dashboard.
- How many SCU does the Conditional Access Optimization Agent consume?
- Microsoft documents the Conditional Access Optimization Agent at less than 1 SCU per run on average. A single run can scan up to 300 users and 150 apps.
- How many SCU does my organisation need?
- Microsoft does not publish a definitive sizing matrix per analyst or per endpoint. The recommended approach is to provision 1 to 3 SCU per hour for evaluation, set overage to unlimited or a budget cap, then size up based on the tenant usage dashboard after the first month.