Quick answer. As of September 2026, Microsoft includes Security Copilot with Microsoft 365 E5, provisions it automatically with Microsoft 365 data access turned on and owner and contributor access inherited from existing administrator roles, and gives 400 Security Compute Units a month for every 1,000 paid user licenses, up to 10,000, shared across the whole tenant, according to Microsoft’s Learn about Security Copilot for Microsoft 365 E5 and E7 included customers page. Before anyone sets up an agent, a regulated tenant replaces the inherited access with role-assignable groups, restricts plugins to owners until each is vetted, and decides Microsoft 365 data access and the workspace’s storage location, which cannot be changed later. It also turns on Microsoft Purview audit and DSPM for AI prompt capture with a retention that matches its examination cycle and gives each agent its own agent identity; if your tenant is GCC, GCC High or DoD, Microsoft currently says Security Copilot is not designed for US government clouds.
The notice arrives as a message center post in the Microsoft 365 admin center or as a banner in the Defender, Purview, Entra or Intune portal: Security Copilot is enabled. No purchase order preceded it, so no security review did either. By the time you read it, Microsoft has already preselected where its data is stored, switched on its access to Microsoft 365 data, and granted owner access to a set of administrator roles you did not choose for this purpose. None of that is a defect; it is Microsoft’s default. The governance question for a regulated IT leader is whether the organization has decided any of it, and what to change before the agents are set up and start drawing on the tenant’s shared capacity.
What arrived in your tenant, and what Microsoft already decided for you
If you are deciding where to start, start with what Microsoft switched on without asking. Microsoft’s Learn about Security Copilot for Microsoft 365 E5 and E7 included customers page answers the inclusion question directly: “Yes, Security Copilot is included for all Microsoft 365 E5 and E7 customers.” The same page qualifies who has it today: “Security Copilot will be available to all eligible Microsoft 365 E5 and E7 customers.” And, as of October 2026, it still dates the rollout: “Rollout started November 18, 2025, for existing Security Copilot customers with Microsoft 365 E5 as of November 18, 2025, and will continue in the upcoming months for all eligible Microsoft 365 E5 and E7 customers.”
Provisioning needs no action from you. The same Microsoft page states: “For eligible customers, Security Copilot is provisioned automatically as part of their subscription.” It lists the configuration settings preselected during auto provisioning, and three of them are governance decisions:
- Customer Data sharing preferences, which Microsoft lists as turned off by default.
- Security Copilot access to data from Microsoft 365 services, which Microsoft lists as turned on by default.
- Default roles that grant Security Copilot owner and contributor access.
Two more defaults concern where data lives. Microsoft’s Understand how Security Copilot is auto provisioned for eligible Microsoft 365 E5 and E7 customers page states: “For the default workspace that Microsoft creates for you, the Customer Data storage location that is preselected is your Microsoft Entra geography.” It adds: “If your tenant’s Customer Data storage location is not in the EU, then prompts are processed globally (US, UK, EU, ANZ) depending on locality and GPU availability.” Its advice for the first step is plain: “Review Owner settings to confirm your organization’s preferred configuration.”
One thing Microsoft did not switch on is the agents. Asked whether Security Copilot agents are enabled automatically, the Learn about Security Copilot for Microsoft 365 E5 and E7 included customers page answers: “No, a customer’s organization is required to set up and deploy agents in the relevant standalone or embedded experiences.” That is the window this checklist uses. To confirm your own tenant is enabled, Microsoft points to notifications in the Microsoft 365 admin center and in-product banners in Defender, Purview, Entra, Intune or the standalone Security Copilot portal. Treat the date you were enabled as the start of an unreviewed change, and review Owner settings first; Microsoft’s Configure Copilot settings with the owner role page states: “You need the Security Copilot owner role to manage owner settings.”
Roles: who can use it and who can change it
The failure mode here is assuming the existing administrator model already governs Security Copilot. It does not, in two directions. Microsoft’s Understand authentication in Microsoft Security Copilot page states: “Security Copilot RBAC roles are not Microsoft Entra roles.” It continues: “Instead, they only control access to the capabilities of the Security Copilot platform and provide no access by themselves to security data.” And it describes the limit on what a user can reach: “Security Copilot doesn’t go beyond the access you have, aligning with Microsoft’s Security and privacy RAI principle.” So the Security Copilot role decides who can use the tool, and each user’s existing Defender, Entra, Intune and Purview permissions decide what data it can reach on their behalf.
Who holds owner access by default is where the documentation needs care. Microsoft’s auto-provisioning page and its authentication page each list the Microsoft Entra, Intune, Purview and other administrator roles that automatically inherit Security Copilot owner access, and as read on September 24, 2026 the two lists are not the same: Conditional Access Administrator appears on the Understand how Security Copilot is auto provisioned for eligible Microsoft 365 E5 and E7 customers list and not on the authentication page’s, and Billing Administrator appears on the Understand authentication in Microsoft Security Copilot list and not on the auto-provisioning page’s. Neither list should be treated as the record for your tenant. The Role assignment page in your own Security Copilot portal is the record, and the auto-provisioning page confirms the defaults can change: “These roles that were added by default, can be modified within the Role assignment page of Security Copilot portal.”
Before you change anything, know the rules Microsoft’s Understand authentication in Microsoft Security Copilot page sets:
- “Security Copilot only supports assigning permissions to Role-assignable groups.”
- “To prevent accidental removal of owners, Security Copilot enforces retention of two owners at all times.”
- Of the Recommended Microsoft Security roles group: “The group is all or nothing.”
- “If the everyone group is removed though, it can’t be assigned again.”
- Of the Security Administrator role: “Don’t assign users this role purely for Copilot access.”
Roles are also scoped per workspace, as the auto-provisioning page describes, so a tenant with more than one workspace repeats this decision for each. The planning rule: name an owner group and a contributor group, both role-assignable and both with a named business owner, then remove the broad defaults deliberately and record what was removed and why.
Plugins, promptbooks, file uploads and shared sessions
If no one has changed the plugin settings since provisioning, the preinstalled set is already open to your contributors. Microsoft’s Manage plugins in Microsoft Security Copilot page states: “By default, all Owners and Contributors have access to preinstalled Microsoft and non-Microsoft plugins.” Custom plugins start narrower: “By default, only owners can add and manage their own custom plugins.” Restricting the preinstalled set changes how new plugins arrive: “Once access is restricted, new preinstalled plugins are made available to Owners only until configured otherwise.” Microsoft also warns about timing: “Restricting access is an immediate change impacting all users of Security Copilot and embedded experiences.” And about reach: “These settings apply to both standalone and embedded Security Copilot experiences.”
Two further points from the same Manage plugins in Microsoft Security Copilot page shape the vetting process. Microsoft advises: “It is good practice to vet custom plugins at a user level first, before making plugins available to the entire organization.” And agents bring their own plugins with them: “When you set up a Security Copilot agent the required plugins for that agent is automatically enabled.” Microsoft adds that those plugins are activated for that agent alone and do not change the availability you set for the organization, so each agent’s plugin set is reviewed at that agent’s own setup.
The adjacent settings are easy to miss. Microsoft’s Understand authentication in Microsoft Security Copilot page states: “Promptbook creation is available to all roles, including the ability to publish a custom promptbook for the tenant.” On file uploads, the Configure Copilot settings with the owner role page states: “You can set it so that no one can upload files or contributors and owners can upload files.” And shared sessions carry results past the viewer’s own permissions. The authentication page states: “Security Copilot needs to access a plugin’s service and data to generate a response, but that same access isn’t evaluated when viewing the shared session.” It adds: “Shared sessions are read-only.”
As a planning rule, schedule the restriction and tell users first, as Microsoft advises, because it takes effect immediately; then restrict preinstalled plugins to owners and re-open each one only after it has been reviewed against a written criterion: what data it reaches, where that data goes, who owns the connection, and which agent needs it. Decide who may publish a tenant promptbook and who may upload files, and tell users that a shared session can show them results their own access would not return. This page names no plugin and ranks none; the criterion is the governance artifact, not a list of allowed products.
Microsoft 365 data access, residency and retention
The decision a privacy officer will ask about first is the one Microsoft set for you. Microsoft’s Understand how Security Copilot is auto provisioned for eligible Microsoft 365 E5 and E7 customers page describes the setting for accessing data from Microsoft 365 services: “By default, this setting is set to ON.” The Learn about Security Copilot for Microsoft 365 E5 and E7 included customers page states what that means: “Relevant Customer Data may be copied, processed, and stored by Security Copilot to provide responses.” It also states the boundary: “Access is scoped to the products and permissions your organization has configured.” And the choice: “Customers can choose not to share their Microsoft 365 service data with Copilot in the Owner settings page.” The same page says that turning it off means the organization cannot use Copilot with Microsoft 365 products such as Microsoft Purview, so the choice is a real trade-off, not a free switch.
Microsoft’s Privacy and data security in Microsoft Security Copilot page adds the facts that make the decision hard to reverse:
- “Once you have created a Workspace, you cannot change its data storage location.”
- “Turning off Microsoft 365 data access does not mean that any data retrieved from those Microsoft 365 services are deleted at that instant.”
- “Session data will be deleted after 180 days of inactivity.”
- Of a customer’s deletion request: “This Customer Data will be deleted within 30 days of that request.”
On data boundaries, the same privacy page states that “Microsoft 365 data accessed by Security Copilot will be processed and stored in location(s) described herein, regardless of the location in which the data was processed or stored pursuant to EU Data Boundary Services” (the sentence continues on Microsoft’s page; it is cut here). Microsoft’s Microsoft Security Copilot Data and Compliance Frequently Asked Questions page states: “At the time of GA, all Microsoft Security Services are out of scope for EU data residency requirements and Security Copilot won’t be listed as an EUDB service.”
The same Microsoft Security Copilot Data and Compliance Frequently Asked Questions page settles how prompts and outputs are classed and how long logs remain:
- “Yes, customer prompts are considered Customer Data.”
- “Yes, Output Content is Customer Data under the Product Terms.”
- “Logs, which contain session data aren’t affected when a session is deleted via the in-product UX.”
- “These logs have a retention period of up to 90 days.”
For a healthcare reader, the same FAQ page states: “Microsoft Security Copilot is now listed and covered by Business Associate Agreement”. That describes Microsoft’s contract coverage; whether your configuration satisfies your own obligations is a determination for your compliance counsel. The planning rule: have the privacy officer sign two decisions before the first agent runs, the Microsoft 365 data-access setting and the workspace storage location, and record both with the date and the signer. For AI assistants near patient data, HIPAA does not require zero data retention; it requires a Business Associate Agreement, technical safeguards and audit controls, as Zero Data Retention for Healthcare AI sets out.
Agents: setup, identity, approval and memory
The decision point is the setup screen, because nothing runs before it. Microsoft’s Setup and Manage Security Copilot agents page states: “You must set up an agent in order to use it.” At setup you choose what the agent runs as: “You have the option of choosing to create an agent identity or assign an existing user account.” Microsoft’s preference is stated: “It’s recommended that you create an agent identity.” So is its permission guidance: “Microsoft recommends that you use roles with the fewest permissions.”
Several agent behaviors need an owner before they are switched on. The same Setup and Manage Security Copilot agents page describes them:
- Partner-built agents that access Microsoft product data: “a Global Administrator within the tenant must approve to allow access of required permissions for the agent.”
- Feedback you give an agent: “This feedback is stored in the agent’s memory, allowing it to tailor its responses and actions based on your insights.”
- Running unattended: “If you prefer the agent to operate in the background, you can set it to run automatically.”
- The page’s own status: “Some information in this article relates to a prereleased product which may be substantially modified before it’s commercially released.”
Licensing and scope have their own conditions. Microsoft’s Learn about Security Copilot for Microsoft 365 E5 and E7 included customers page states: “Partner-built agents may require a separate license from the partner (purchased via Security Store); SCU costs for third-party agents are included, but this might change in the future as we roll out Security Copilot inclusion more broadly.” It also states: “Some agents may require prerequisites that involve products outside of Microsoft 365 E5 and E7, which aren’t covered.”
Responsibility stays with you. Microsoft’s Application card: Microsoft Security Copilot agents states: “Agents may also perform scoped actions within configured permissions when prompted, which require an appropriate user or administrator approval.” It sets the expectation on oversight: “Users must implement appropriate human oversight, when configuring and deploying agentic AI systems in domains where agent actions are irreversible or highly consequential.” And it states the accountability plainly: “Customers remain responsible for reviewing outputs, validating decisions, and ensuring compliance with applicable laws, regulations, and organizational policies.”
The planning rule, per agent: one named business owner, one agent identity with the fewest permissions that do the job, a written statement of which actions stay human-approved, a decision on whether it may run automatically, and a periodic review of what it has stored in memory. Which agents are available in which product on a given day changes with Microsoft’s rollout and prerelease status, so confirm availability in your tenant and do not plan from a list. If the agents your organization builds are Copilot Studio agents rather than Security Copilot’s, their governance is a different product with its own record, covered in Copilot Studio Governance for Enterprise Agent Estates.
Audit and prompt capture for the examiner
The question an examiner or internal audit will ask is where the prompts and responses are logged, and the default answer may be nowhere you have looked. Microsoft’s Access the Security Copilot audit log page states: “During the first run experience, a Security Administrator may opt into allowing Microsoft Purview to access, process, copy and store administrator actions, user actions, and Copilot responses.” Capture is a choice someone makes, not a default you inherit.
Microsoft’s Access the Security Copilot audit log page also separates what the Unified Audit Log (UAL) and DSPM for AI each hold: “The UAL from Purview gives you visibility into information such as administrator events and activity metadata, whereas DSPM for AI provides insights into prompt/response pairs.” It narrows where content lives: “Customer content such as that contained within the prompt and response pair is currently only included through Microsoft Purview DSPM for AI.” It sets the default clock: “The default retention period for audit logs is 180 days but can be extended using audit log retention policies.” And it warns that the people who read the logs are a separate decision: “These access rights might be different from those in Security Copilot.” On timing, Microsoft’s Configure Copilot settings with the owner role page states: “In most scenarios, logs are available within 24 hours in Microsoft Purview after enabling the capability.”
As a planning rule, turn capture on, including DSPM for AI for prompt and response content, before the first agent is set up; set audit retention to the clock your examiners and record schedule require, not the default; and name who in Purview may read Security Copilot activity.
The capacity is one shared pool
The failure mode is an agent set to run automatically consuming capacity the security team expected to use for its own prompts. Microsoft’s Learn about Security Copilot for Microsoft 365 E5 and E7 included customers page states the allocation: “Customers with Microsoft 365 E5 and E7 will have 400 Security Compute Units (SCU) each month for every 1,000 paid user license, up to 10,000 SCUs each month at no additional cost.” Its own example: “Example 2: An organization with 4,000 user licenses gets 1,600 SCUs/month.” By the same rule, 3,500 paid user licenses give 1,400 SCUs a month and 25,000 give 10,000, which is the cap; a tenant above 25,000 paid licenses still receives 10,000. The same page states: “SCU allocations reset monthly and don’t roll over if unused.” It describes the Default Security Copilot Capacity as a pool that cannot be modified and is shared across all users and experiences in the tenant.
Microsoft’s Microsoft Security Copilot Security Compute Units and capacity page defines the unit: “Security Compute Units (SCUs) represent the compute capacity required to run Security Copilot workloads.” Visibility is limited to owners. Microsoft’s Manage security compute unit usage in Security Copilot page states: “Copilot owners can view the usage over time within the Microsoft Security Copilot usage monitoring dashboard.” It states the window: “The dashboard includes up to 90 days of data”. The dashboard separates agent use and automated actions from manual prompts, which is what an owner needs to see which agents are drawing on the pool.
Overage terms are announced but not yet in effect. The Learn about Security Copilot for Microsoft 365 E5 and E7 included customers page states: “Usage beyond the allocated SCUs will be throttled at a future date.” It continues: “Customers have an option to scale beyond the allocated amount at $6 USD for each SCU on a pay-as-you go basis at that time.” And: “Customers will get a 30-day advanced notification when this option is available.” Microsoft publishes no date for either. The planning rule: name the owner who reads the usage dashboard on a fixed schedule, decide which agents may run automatically, and decide in advance what happens when the month’s allocation runs short.
When this checklist is the wrong starting point
If your situation is one of these, start somewhere else or confirm one fact first. Microsoft’s Microsoft Security Copilot Data and Compliance Frequently Asked Questions page states: “Currently, Security Copilot isn’t designed for use by customers using US government clouds, including but not limited to GCC, GCC High, DoD, and Microsoft Azure Government.” Its Application card: Microsoft Security Copilot agents states: “Government and Microsoft Sovereign Public/Private Cloud: Security Copilot isn’t supported in these environments at this time.”
- If your tenant is GCC, GCC High, DoD or Azure Government, this governance work is deferred, not done, and Microsoft publishes no date for a change; for the Intune view of the same boundary in a GCC High estate, see Is Microsoft Intune CMMC Compliant? What It Covers, and What It Does Not.
- If your tenant has not been enabled yet, Microsoft describes a phased rollout to eligible customers; confirm enablement through the admin center notifications before you plan around it.
- If no one in the organization is accountable for how AI is used in security tooling, name that owner first; no setting substitutes for one, and Microsoft places the responsibility for outputs and decisions with the customer.
- If the decision in front of you is really about Microsoft 365 Copilot, that is a different product with its own governance, and this checklist does not answer it.
- If the organization intends to hand security operations to an outside provider, that is an operating-model decision this page does not make; Microsoft’s authentication page notes that the tenant provisioned for Security Copilot does not need to be the tenant analysts sign in from, so any such cross-tenant access is itself a governed decision.
What to ask of whoever helps you set it up
Whether the work is done by your own team or with outside help, ask to see the evidence, not a description of it:
- Show the role-assignable groups for owner and contributor, and the list of default role assignments removed, with the reason for each.
- Show the plugin restriction state and the vetting record for each plugin re-opened to contributors.
- Show the Microsoft 365 data-access decision and the workspace storage location, with who signed each and when.
- Show Purview audit and DSPM for AI capture enabled, with the retention setting and who may read it.
- Show an agent identity and a named owner for each agent, and which of its actions stay human-approved.
- Show who reads the usage dashboard, and the decision on which agents may run automatically.
- Show the configuration documented and handed to your team to run, with no dependency on the people who set it up.
How i3solutions approaches it
i3solutions maps governance to named control families, enforces it in the platform through Entra ID, Purview, and Azure Policy, and evidences it continuously rather than reconstructing it at audit. For Security Copilot, that is a project with an end date: designing the owner and contributor groups, restricting and vetting plugins, taking the Microsoft 365 data-access and storage-location decisions to the people who must sign them, turning on Purview audit and prompt capture, setting up agent identities and approval rules, and mapping each setting to your control families with the evidence to show an examiner, with embedded specialists alongside your team where it needs them. i3solutions governs identity and access for regulated Microsoft estates with senior, U.S.-based engineers and leaves an audit-defensible record. i3solutions has deep experience implementing identity governance for enterprises in aerospace and defense manufacturing, financial services, and healthcare, including environments with CMMC and ITAR obligations. i3solutions has been a Microsoft Partner with 30 years of enterprise technology delivery experience and has delivered 1,500+ Microsoft engagements across aerospace and defense, financial services, and health sciences. An i3solutions engagement does not produce managed-service ownership, a replacement for the internal team, open-ended scope expansion, or vendor lock-in. The configuration is yours to run when the project ends. This work sits within i3solutions’ governance practice, described in Embedding Governance into How the Enterprise Operates and Scales.
Key Takeaways
- Security Copilot arrives in eligible Microsoft 365 E5 tenants provisioned automatically, with Microsoft 365 data access on and owner and contributor access inherited from existing administrator roles.
- The agents are not switched on for you, which leaves a window to govern roles, plugins, data access and audit before any agent runs.
- Replace inherited access with role-assignable groups, and read your own Role assignment page rather than either of Microsoft’s two default lists.
- Restrict plugins to owners until each is vetted; the change is immediate, so schedule it.
- Decide Microsoft 365 data access and the workspace storage location deliberately; the storage location cannot be changed later.
- Turn on Purview audit and DSPM for AI capture before the first agent runs, and set retention to your examination clock.
- Give every agent its own identity and owner, and name who watches the shared monthly capacity.
- In GCC, GCC High or DoD, Microsoft currently says Security Copilot is not designed for US government clouds.
Frequently Asked Questions
Is Security Copilot included in Microsoft 365 E5?
Yes, for eligible customers, in a phased rollout. According to Microsoft Learn, Security Copilot is included for Microsoft 365 E5 and E7 customers and will be available to all eligible customers, with the rollout that started November 18, 2025 still described as continuing in the upcoming months, as of October 2026. According to Microsoft Learn, eligible tenants are provisioned automatically, and enablement is confirmed through Microsoft 365 admin center notifications and in-product banners.
How many Security Compute Units does Microsoft 365 E5 include?
According to Microsoft Learn, Microsoft 365 E5 and E7 customers receive 400 Security Compute Units each month for every 1,000 paid user licenses, up to 10,000 each month at no additional cost. According to Microsoft Learn, the allocation resets monthly, unused units do not roll over, and the default capacity cannot be modified and is shared across all users and experiences in the tenant.
Are Security Copilot agents turned on automatically?
No. According to Microsoft Learn, a customer’s organization is required to set up and deploy agents in the relevant standalone or embedded experiences, and an agent must be set up before it can be used. Microsoft Learn recommends creating an agent identity at setup rather than assigning an existing user account.
Is Security Copilot available in GCC High?
No. According to Microsoft Learn, Security Copilot currently is not designed for use by customers in US government clouds, including GCC, GCC High, DoD and Microsoft Azure Government, and it is not supported in government and sovereign cloud environments at this time. Microsoft Learn publishes no date for a change.
Where are Security Copilot prompts logged for audit?
In Microsoft Purview, once capture is turned on. According to Microsoft Learn, a Security Administrator may opt in during the first run experience; the Unified Audit Log carries administrator events and activity metadata, while prompt and response content is currently only included through Microsoft Purview DSPM for AI. According to Microsoft Learn, the default audit log retention is 180 days and can be extended with audit log retention policies.
What happens when we use more than the included SCUs?
According to Microsoft Learn, usage beyond the allocated SCUs will be throttled at a future date, and customers will then have an option to scale beyond the allocation on a pay-as-you-go basis, with 30 days of advance notice when that option is available. Microsoft Learn publishes no date for either change.
Planning the Decision
If Security Copilot has just appeared in your tenant, the agents are the deadline you control: settle roles, plugins, data access, audit and agent ownership before the first one is set up, and keep the record of who decided each, evidenced against your control families.
