Security Copilot: Security Compute Units (SCU) and Licensing

What it does

SCUs are the unit of capacity you buy to run Security Copilot. You provision a baseline of units, pay for them by the hour, and let overage units absorb spikes — there are no per-user licences.

Key facts

Provisioned SCUs cost $4/hour; overage SCUs cost $6/hour (standalone list pricing).
Minimum commitment is 1 provisioned SCU. You can assign up to 100 provisioned SCUs.
Provisioned capacity is billed by the hour in whole-hour blocks, whether or not you use it. Overage is billed on actual consumption, down to one decimal place (not rounded up to whole units).
Capacity changes take effect within about 30 minutes; there's no long-term contract — you can scale up or down any time.
You can cap the maximum overage SCUs allowed per hour to keep spikes from running the bill away. Set it to 0 to disable overage entirely.
E5/E7 inclusion (from 18 Nov 2025): 400 SCUs/month per 1,000 paid E5 licences, up to 10,000 SCUs/month, at no extra cost — rolling out in phases.
Billing is per hour with a one-hour minimum: provision, deprovision, and re-provision within the same clock hour and you get charged for both units in that hour. Make changes at the top of the hour.
Usage is tracked in the portal's capacity/usage dashboards so you can see which features and agents burn units.

When to use / skip

Everyone using Security Copilot is on the SCU model — there's no seat alternative. The real decision is how much baseline to provision. If usage is steady (agents running continuously, a busy SOC), provisioned capacity at $4 is cheaper than leaning on $6 overage. If usage is bursty and occasional, run a thin baseline and let overage carry the peaks. For E5/E7 shops, start from the included allocation and only buy provisioned SCUs if you consistently blow past it.

Configuration decisions

Baseline provisioned SCU count — size it to your steady-state load, not your worst day.
Overage cap: the hourly ceiling that protects you from runaway spend. Pick a number, don't leave it open-ended by accident.
Whether to run agents 24/7 (they consume capacity continuously) or schedule/gate them.
For E5/E7 tenants: whether the included allocation covers you, or you top up with paid provisioned capacity.
Who holds the authority to change capacity — this is a spend lever, treat it like one.

Gotchas

Provisioned SCUs bill whether idle or not. Over-provision "to be safe" and you're paying $4/hour per unit for nothing.
The whole-hour billing block catches people who flip capacity up and down through the hour — you pay for the peak count in each clock hour.
Overage at $6 is 50% more than provisioned at $4. Sustained overage means you under-provisioned; fix the baseline.
Autonomous agents are the biggest silent consumer — a phishing-triage agent chewing through a busy mailbox will move your SCU numbers, and it runs without a human in the loop.
E5/E7 inclusion is capped at 10,000 SCUs/month and phased; a large tenant can still exceed it and land back in paid territory.

Consultant notes

Model the monthly bill as (provisioned SCUs x $4 x hours) + expected overage before anyone signs. Clients anchor on the $4 headline and forget it's per hour, per unit, 24/7.
The commercial pitch shifted with E5 inclusion — for E5 accounts, frame paid SCUs as "capacity beyond what you already get", which is a much easier conversation.
Watch agents in the cost model specifically; they're the line item most likely to surprise a finance team.
There are third-party SCU calculators floating around, but build the number yourself from the client's real workload — generic estimates mislead.

Confirm current $4/$6 SCU pricing on the Microsoft pricing page before quoting — this is list price and it moves.