Withdrawn: Microsoft's notice that Security Copilot arrives in E5 and E7 tenants switched on, with Microsoft 365 data access on by default

Withdrawn: Microsoft's notice that Security Copilot arrives in E5 and E7 tenants switched on, with Microsoft 365 data access on by default

24 September 2026: Microsoft posted Message Center item MC1478465 on 24 September 2026 telling Microsoft 365 E5 and E7 customers that Security Copilot, its AI assistant for security teams, is now part of their existing licence: "beginning today, your organization has access". No purchase or action is needed, and Microsoft provisions the service automatically. The rollout began on 18 November 2025 for tenants that already had Security Copilot and has been reaching other eligible E5 and E7 tenants in phases since.

What is included

• Capacity: 400 Security Compute Units (SCUs) a month for every 1,000 paid user licences, up to 10,000 SCUs a month. It scales down for smaller tenants: Microsoft's example gives 160 SCUs a month for 400 licences.
• Where it works: agents and assistance inside Microsoft Defender, Entra, Intune and Purview, and the Security Copilot portal, plus developer tools and APIs for custom agents.
• What still costs extra: Microsoft Sentinel data lake compute or storage, non-agentic Data Security Investigations in Purview, Azure Logic Apps used with Security Copilot, and third-party agents bought through the Microsoft Security Store.

The defaults Microsoft sets for you

Microsoft's provisioning documentation lists what is preselected:

• Customer data, meaning prompts and responses, is stored in the tenant's Microsoft Entra geography, or its Microsoft 365 data-location override where one exists.
• Prompts are processed in the EU if data is stored in the EU; otherwise they may be processed in the US, UK, EU or Australia and New Zealand depending on capacity.
• Security Copilot's access to data from Microsoft 365 services such as Purview is on by default. Microsoft says relevant customer data "may be copied, processed, and stored" to produce answers.
• Sharing data with Microsoft for human review is off by default.
• Owner access is inherited by existing roles including Global Administrator, Security Administrator, Conditional Access Administrator, Intune Administrator and several compliance roles.

To opt out of the entitlement altogether, Microsoft says to contact support; the post names no admin switch for that.

Who is affected

Organisations on Microsoft 365 E5 or E7, their security and compliance teams, and data-protection officers who keep records of processing and data-location commitments.

What to do

• Open the Owner settings in the Security Copilot portal and confirm the storage location, prompt-processing location and Microsoft 365 data access match your policies.
• Review who has inherited owner and contributor access, and trim it to the people who need it.
• Record the new processing in your data-protection documentation, and decide whether a data-protection impact assessment is needed.
• Watch SCU use against the monthly allowance before enabling paid add-ons, and decide deliberately whether to keep the service or ask support to remove it.

Withdrawn by Microsoft. On 19 October 2026 Microsoft added to MC1478465 that the post had not reached its intended audience and could be disregarded, and no replacement notice has been published; we keep this item for the record. It rests on Microsoft’s own Message Center post, read through a public archive, and Microsoft’s Learn pages.

Update, 28 October 2026: Microsoft withdrew this notice. On 19 October it added that MC1478465 had not reached its intended audience and could be safely disregarded, and the post expired from Message Center on 21 October. Tenants should not act on the provisioning described above unless Microsoft announces it again.

Sources

• Microsoft 365 Message Center MC1478465, Security Copilot is now included as part of your Microsoft 365 E5/E7 plan, via the public Message Center archive - 24 September 2026
• Microsoft Learn: Learn about Security Copilot for Microsoft 365 E5 and E7 included customers - 19 June 2026
• Microsoft Learn: Understand how Security Copilot is auto provisioned for eligible Microsoft 365 E5 and E7 customers - 18 June 2026
• Microsoft 365 Message Center MC1478465, version history with the 19 October update, via the public Message Center archive - 19 October 2026