Updated October 4, 2026.
Microsoft AI cybersecurity tools are mostly one assistant, Security Copilot, plus AI features built into the products many companies already pay for: Defender, Sentinel, Entra, Purview and Intune. The biggest change in 2026 is licensing. Microsoft now includes Security Copilot in Microsoft 365 E5 and E7, so many large organizations have it without a separate purchase, while smaller teams still face a usage-based price. This guide explains what each tool does, what it costs, and which parts matter for a business your size.
What are Microsoft’s AI cybersecurity tools?
Table of Contents
Two different ideas hide under this name, and mixing them up is the most common mistake when people shop for it. The first is AI that helps defenders: it triages alerts, hunts for threats and drafts incident summaries. The second is security for AI: controls that stop staff and software agents from leaking data or being hijacked through tools like Microsoft 365 Copilot. Microsoft sells both.
| Tool | What it does | The AI part |
|---|---|---|
| Security Copilot | Security assistant, used in its own portal and inside other Microsoft security products | Agents built into Defender, Entra, Intune and Purview. Microsoft announced a dozen new agents at Ignite 2025, plus more than 30 partner-built agents in its Security Store. |
| Microsoft Defender (XDR, Endpoint, Office 365, Cloud Apps) | Detection and response across devices, email, identity and cloud apps | Real-time protection for AI agents built with Copilot Studio, which blocks unsafe tool use while the agent is running |
| Microsoft Sentinel | Cloud SIEM that collects and analyzes security logs | Security Copilot can work with Sentinel data. Sentinel data lake compute and storage are billed separately. |
| Microsoft Entra | Identity and access | Entra Agent ID gives AI agents their own identities, with Conditional Access applied to them. Shadow AI detection in Entra Internet Access finds unmanaged AI apps. |
| Microsoft Purview | Data security and compliance | Data loss prevention for Microsoft 365 Copilot, oversharing reports and automatic labeling of sensitive data |
| Security Dashboard for AI | One view of AI-related risk | Combines signals from Defender, Entra and Purview. Microsoft says it is included at no extra cost. |
Sources for the table: Microsoft’s own security blog posts on ambient and autonomous security and on securing agentic AI end to end.
Security Copilot pricing in 2026
Security Copilot is billed in Security Compute Units (SCUs), a measure of the compute it uses. There are now three ways to get it:
- Standalone: $4 per SCU per hour, provisioned in Azure and billed by the hour, according to licensing guides from TrustedTech and SAMexpert. A single SCU left running 24 hours a day for 30 days comes to $2,880 ($4 x 24 x 30), so your real bill depends on how many hours you provision.
- Included with Microsoft 365 E5: 400 SCUs per month for every 1,000 user licenses, up to 10,000 SCUs a month, with core agent features across Defender, Entra, Intune and Purview. Unused units do not roll over to the next month. Sentinel data lake costs and third-party agents are not covered.
- Included with Microsoft 365 E7: $99 per user per month, generally available from May 1, 2026. It bundles E5, Microsoft 365 Copilot, the Entra Suite and Agent 365, so it carries the same Security Copilot allowance.
Microsoft’s own Message Center notice (as mirrored by Microsoft MVP Merill Fernando) describes the E5 and E7 inclusion, and an earlier notice described a phased rollout between April 20 and June 30, 2026. If you are on E5, check your own admin center before buying SCUs you may already have.
Which Microsoft AI cybersecurity tools fit your business?
- You already have Microsoft 365 E5 or E7: switch on the Security Copilot agents in the products you use most. Microsoft lists phishing triage, threat hunting, identity risk remediation and compliance tasks among the work its agents automate.
- You are a small team on a smaller plan: standalone Security Copilot is hard to justify at hourly pricing. Start with Defender for Office 365 (Plan 1 is about $2 per user per month, Plan 2 about $5, and Plan 1 is included in Business Premium) and fix your email authentication first. Our guide to AI phishing detection tools covers that in detail.
- Your worry is employees pasting data into AI: look at Purview data loss prevention and the shadow AI detection in Entra Internet Access rather than a detection assistant.
- You do not use Microsoft’s stack: these tools are far less useful on their own. Compare the options in our guides to the best AI cybersecurity software and AI threat detection tools pricing.
This is our reading of how the products are positioned, not a lab test. Microsoft does not publish a single time-saving figure we could verify, so run a short pilot on your own alerts before committing budget.
Examples of AI in cybersecurity with Microsoft tools
- Phishing triage: an agent reviews user-reported emails and sorts the real threats from false alarms.
- Threat hunting: analysts ask questions in plain language instead of writing every query by hand, though knowing the Kusto Query Language (KQL) still helps you check the answer.
- Identity risk remediation: agents in Entra flag risky sign-ins and suggest fixes.
- Policy and device tasks: agents in Purview and Intune help review policies and offboard devices.
- Protecting AI itself: runtime protection for Copilot Studio agents, and shadow AI detection for apps nobody approved.
Is there a Microsoft AI cybersecurity certification?
There is no certification with AI cybersecurity in its name, but Microsoft’s security exams now cover Security Copilot and AI security. The usual path, with US list prices that vary by country:
| Exam | Level | Who it suits | Price |
|---|---|---|---|
| SC-900 | Fundamentals | Anyone new to Microsoft security. No prerequisites. Recent versions include Security Copilot content. | $99 |
| SC-200 | Associate | Security operations analysts. Expect to write KQL. | $165 |
| SC-500 | Associate (new) | Cloud and AI security engineers. It replaces AZ-500, which retires on August 31, 2026. | Check Microsoft Learn |
| SC-100 | Expert | Cybersecurity architects with real production experience | $165 |
Training on Microsoft Learn is free; only the proctored exam costs money. Prices come from third-party certification guides and Microsoft changes them, so confirm on the exam page before you book. If you are weighing the career side, our look at jobs AI will replace by 2030 shows why security roles keep growing.
Frequently Asked Questions
What is the US Microsoft AI called?
Microsoft’s AI assistant family is called Copilot. Microsoft 365 Copilot works inside Word, Excel, Outlook and Teams, Copilot Studio is for building your own agents, and Security Copilot is the version made for security teams.
Which AI tool is best for cybersecurity?
No single tool is best for everyone, and we have not benchmarked them. If you already pay for Microsoft 365 E5, Security Copilot is the obvious one to try because the allowance is included. For email threats, a dedicated email security layer is often the better first purchase, and our cybersecurity software comparison covers the alternatives.
What are the AI tools available in Microsoft?
The main ones are Microsoft 365 Copilot for everyday work, Copilot Studio for building agents, Microsoft Foundry for building AI applications, and Security Copilot for security operations. Defender, Entra and Purview also carry AI features of their own.
Does Microsoft have a cyber security program?
Yes, in three senses. Microsoft sells a full security product line (Defender, Sentinel, Entra, Purview, Intune and Security Copilot). It runs its own company-wide effort called the Secure Future Initiative to harden its products. And it offers role-based security certifications through Microsoft Learn.
Is Security Copilot included in Microsoft 365 E5?
Yes. Microsoft states that E5 and E7 tenants receive 400 Security Compute Units per month for every 1,000 licensed users, up to 10,000 a month. Extra capacity, Sentinel data lake usage and some partner agents cost extra.