Microsoft Security Copilot: 2025 Guide to Portal, Pricing, Intune, Licensing, Certification, Download, and Agents

Microsoft Security Copilot is an AI-powered security assistant launched in 2023, helping teams analyze threats, respond to incidents, and manage posture using natural language prompts. As of October 26, 2025, it’s available via standalone portal and embedded in tools like Defender XDR, Sentinel, Intune, and Entra. This guide covers the portal, access links, pricing, Intune integration, licensing, certification, download options, and agents, based on Microsoft Learn and Azure docs.

Security Copilot Portal

The Security Copilot portal is a standalone web interface for AI-driven security tasks.

Access: Sign in at securitycopilot.microsoft.com with Microsoft Entra ID credentials.
Features: Prompt-based analysis, session sharing, tenant switching, plugin management (e.g., Sentinel, Intune).
Requirements: Azure subscription, Entra ID; minimum 1 SCU provisioned.

Security Copilot Link

Direct access links:

Portal: securitycopilot.microsoft.com
Azure Marketplace: azure.microsoft.com/en-us/marketplace/apps/microsoft-corporation.security-copilot
Docs: learn.microsoft.com/en-us/copilot/security/
Pricing Calculator: azure.microsoft.com/en-us/pricing/calculator/?service=security-copilot

Security Copilot Pricing

Pricing is based on Security Compute Units (SCUs), billed hourly (~$4/SCU/hour) with minimum 1 SCU (24/7 for $35,040/year).

Model	Cost	Details
Provisioned SCU	$4/hour (min 1 SCU)	Billed monthly; 24/7 for $35,040/year
Overage SCU	$4/hour (as needed)	Optional cap/unlimited; for surges

Calculator: azure.microsoft.com/en-us/pricing/calculator/?service=security-copilot (Azure account needed).
Notes: No monthly license; consumption-based. MACC eligible; starts at 1 SCU ($4/hr).
Reddit: “$35K/year minimum—April Fools?” (r/AZURE, 2024).

Security Copilot Intune

Security Copilot integrates with Intune for device management insights, compliance checks, and remediation guidance.

Features:
Device info (enrollment, compliance, policies).
Policy creation/comparison; troubleshooting (e.g., non-compliant devices).
Vulnerability remediation agent (preview): Prioritizes CVEs, step-by-step Intune fixes.
Access: Embedded in Intune admin center; requires Security Copilot license + Intune Plan 1.
Roles: Intune Administrator or Security Administrator in Entra ID.
Preview: Agents for device compliance, policy impact analysis.