The Microsoft Licensing Change You Need to Know About
Microsoft just made a significant change to its Microsoft 365 licensing: Security Copilot, which previously cost $4/user/month on top of your existing subscription, is now included in E5 licenses starting April 20, 2026. They’re also launching a new E7 “Frontier Suite” tier that bundles advanced AI capabilities. Before you get excited (or overwhelmed), here’s what Security Copilot actually does, who should care, and whether it changes the E3-vs-E5 decision for your business.
What Is Microsoft Security Copilot? (In Plain English)
Security Copilot is Microsoft’s AI assistant for cybersecurity work. Think of it like having ChatGPT, but trained specifically on security data and given access to your organization’s security logs, alerts, and telemetry from across your Microsoft environment.
What it actually does:
- Analyzes security alerts and explains them in plain language instead of cryptic technical jargon
- Investigates incidents by automatically correlating data across multiple security tools (Defender, Sentinel, Entra ID, etc.)
- Suggests specific remediation steps for vulnerabilities and active threats
- Generates security reports and executive summaries
- Answers natural language questions about your security posture (“Show me all failed login attempts from unusual locations this week”)
- Creates incident response playbooks and guides analysts through investigation workflows
The pitch from Microsoft: Instead of security analysts manually digging through thousands of log entries and alerts, they ask Security Copilot questions in plain English and get AI-generated insights, correlations, and recommendations.
The reality: It’s genuinely useful for organizations with dedicated security staff who understand security concepts and know what to look for. For small and medium businesses without a security team, it’s less immediately valuable because you still need someone who knows what questions to ask, how to interpret the answers, and what actions to take based on the recommendations.
Security Copilot is a force multiplier for security expertise, not a replacement for it. If you don’t have security expertise on staff, adding Security Copilot alone won’t solve that gap.
What Changed: The April 20, 2026 Announcement
Microsoft announced two significant licensing changes that take effect April 20, 2026:
Security Copilot Now Included in E5
Previously: Security Copilot was a separate add-on costing $4/user/month on top of your Microsoft 365 subscription. Organizations that wanted it had to explicitly purchase and enable it.
Now: Security Copilot is bundled with Microsoft 365 E5 and Microsoft 365 E5 Security licenses at no additional cost.
Who gets it: Anyone on E5 plans automatically receives access. No action required on your part—it becomes available in your tenant.
Who this affects: If you were already paying for Security Copilot as an add-on to E5, your costs just decreased. If you weren’t using it, you now have access to explore it without additional licensing costs.
New E7 “Frontier Suite” Tier
Microsoft also announced a new top-tier license: Microsoft 365 E7 Frontier Suite.
What it includes: Builds on the E5 foundation with additional advanced AI capabilities, including Security Copilot plus other AI agents and advanced Copilot features across the Microsoft 365 stack.
Pricing: Not yet publicly disclosed. Expect it to be a significant premium over E5 based on Microsoft’s positioning.
Target market: Large enterprises with hundreds or thousands of users and dedicated teams to deploy, manage, and extract value from cutting-edge AI capabilities.
What this signals: Microsoft is differentiating its license tiers increasingly on AI capability access. They’re pushing AI features down-market (Security Copilot moving from add-on to E5 inclusion) while creating new premium tiers for the most advanced capabilities. This is part of their broader strategy to make Copilot and AI pervasive across the entire Microsoft 365 ecosystem.
Should Your Business Care About This?
For Businesses Already on E5
You just gained access to a capability that previously cost extra. This is unambiguously good news if you were already using Security Copilot—your costs decrease. If you weren’t using it, you now have the option to explore it at no additional cost.
Worth exploring if: You have someone on staff who handles security monitoring, even part-time. Security Copilot can make their work more efficient by accelerating incident investigation, generating reports, and surfacing insights they might miss manually reviewing logs.
Don’t force it if: You don’t have security expertise. Security Copilot is a tool for people who already understand security concepts. It won’t magically give you security competence if that capability doesn’t exist in your organization.
For Businesses on E3 Considering Upgrading
This licensing change doesn’t fundamentally alter the E3-vs-E5 decision for most small and medium businesses. The security capabilities that matter most for smaller organizations—Defender for Office 365 Plan 2, advanced threat protection, data loss prevention, device compliance enforcement—were already part of why you’d choose E5 over E3.
Security Copilot is a nice bonus if you upgrade to E5 for other reasons, but it shouldn’t be the primary driver of an E5 upgrade decision unless you have dedicated security staff who will actively use it to manage and monitor your environment.
The core E3-vs-E5 calculation remains: Do you need the advanced security, compliance, and management capabilities that E5 provides? If yes, upgrade. If no, stay on E3. Security Copilot’s inclusion doesn’t change that fundamental analysis.
For Businesses on Business Premium or Business Standard
E5 remains enterprise-focused and is likely overkill for most organizations under 100 users. The jump from Business Premium to E5 is significant both in cost (roughly $30-40/user/month difference) and complexity (E5 has many more features to configure and manage).
Security Copilot’s inclusion doesn’t change this recommendation. Business Premium already includes strong security features (Defender for Office 365 Plan 1, basic threat protection, device management). For most SMBs, the priority should be fully utilizing what Business Premium offers rather than upgrading to E5 for capabilities you won’t effectively use.
The Real Value: Who Actually Benefits?
Organizations That Benefit Most from Security Copilot
1. Businesses with dedicated security staff or vCISO arrangements
If you have someone—whether in-house employees, outsourced SOC analysts, or a virtual CISO arrangement—actively monitoring security, investigating incidents, and managing your security posture, Security Copilot amplifies their effectiveness significantly.
They can investigate potential threats faster by asking questions instead of manually correlating logs. They can generate compliance reports more easily. They can catch patterns across systems that would be difficult to identify through manual review. Security Copilot turns a single security analyst into a more effective team.
2. Organizations in regulated industries
Healthcare (HIPAA), financial services (SOX, GLBA), legal practices (confidentiality requirements)—industries with compliance mandates that demand detailed security documentation and formal incident response processes.
Security Copilot can generate compliance reports, document incident investigations with detailed timelines and findings, and provide audit trails that satisfy regulatory requirements. These capabilities save significant time during audits and reduce the risk of compliance violations due to incomplete documentation.
3. Businesses with complex IT environments
Organizations running multiple cloud platforms (Azure, AWS, Google Cloud), hybrid on-premises and cloud infrastructure, dozens of SaaS applications, and complex data flows between systems.
Security Copilot excels at correlating security data across disparate systems and surfacing insights that are nearly impossible to find manually. The more complex your environment, the more value Security Copilot provides in making sense of the security telemetry it generates.
Organizations That Won’t Get Immediate Value
1. Small businesses without security expertise
If nobody on your team knows what a SIEM is, how to investigate a security alert, or what “lateral movement” means in a security context, Security Copilot won’t magically provide security competence.
It’s a tool that amplifies existing security knowledge. It’s not a replacement for understanding security fundamentals. Adding Security Copilot to an organization without security expertise is like giving a Formula 1 race car to someone who doesn’t know how to drive—the capability exists, but you can’t use it effectively.
2. Businesses with simple IT environments
If you’re running Microsoft 365, a couple of standard SaaS applications (Salesforce, Slack, basic productivity tools), and straightforward infrastructure, you probably don’t generate enough diverse security telemetry to make Security Copilot’s advanced correlation and cross-system analysis capabilities worthwhile.
The tool shines when you have complex environments generating lots of security data across many systems. Simple environments don’t provide enough signal for its capabilities to demonstrate clear value.
3. Organizations that don’t actively monitor security
Security Copilot requires someone to actually use it regularly. If your current approach to security is “we have antivirus software and hope nothing bad happens,” adding Security Copilot won’t fundamentally change that posture.
You need process and people changes first: someone monitoring security alerts, investigating anomalies, responding to incidents. Security Copilot makes those activities more efficient, but it doesn’t create the practice of doing them if it doesn’t exist.
What About the E7 “Frontier Suite”?
Microsoft hasn’t released complete details about E7 licensing, but based on their announcements and positioning, it’s clearly targeted at large enterprises that want access to Microsoft’s most advanced AI capabilities across their entire operation.
What we know so far:
- Builds on the E5 foundation with all E5 capabilities included
- Includes Security Copilot plus additional AI agents for various workflows
- Focus on “frontier” AI models—Microsoft’s term for their most advanced, cutting-edge capabilities
- Likely includes preview access to new Copilot features before they roll out to lower tiers
- Pricing will almost certainly be a significant premium over E5 (expect $50+ per user per month more than E5)
For small and medium businesses: E7 is almost certainly not relevant for you. If E5 already feels like overkill for your organization, E7 is extreme overkill. This is Microsoft’s play for Fortune 500 enterprises with thousands of users and dedicated teams to deploy, manage, and optimize AI implementations across the organization.
Unless you’re running a large enterprise with substantial IT and security teams, mature processes, and budget to invest in cutting-edge capabilities, E7 shouldn’t be on your consideration list.
The E3 vs. E5 Decision Tree (Updated for 2026)
The inclusion of Security Copilot in E5 adds value to that tier, but it doesn’t fundamentally change the decision framework for most businesses.
Stick with E3 (or Business Premium for smaller orgs) if:
- You have fewer than 50-100 users
- You don’t have dedicated IT or security staff
- Your IT environment is relatively straightforward (Microsoft 365, standard SaaS apps, basic infrastructure)
- Compliance requirements are basic (no HIPAA, SOX, or industry-specific mandates)
- Budget is a primary constraint and you need to maximize value per dollar spent
- You’re effectively using the security features E3 already provides
Consider E5 if:
- You’re in a regulated industry requiring advanced compliance and security capabilities
- You have (or plan to hire/contract) dedicated IT and security staff who can leverage advanced features
- You need capabilities like advanced threat protection, data loss prevention, or information governance
- Your cyber insurance policy requires or incentivizes specific security controls that E5 provides
- You have complex device management needs (BYOD policies, mobile device management, conditional access)
- You’ve outgrown E3’s capabilities and are already paying for multiple add-ons that E5 bundles
Security Copilot’s inclusion in E5 is a nice bonus if you upgrade for other reasons. It shouldn’t be the primary driver of the decision unless you have a mature security practice that will immediately leverage it.
Practical Steps: What to Do Now
If You’re Already on E5
- Security Copilot became available in your tenant on April 20, 2026—check your Microsoft 365 admin center
- If you have security staff, encourage them to explore it; don’t mandate usage if they don’t find it valuable
- Check whether you were paying for Security Copilot as a separate add-on (you can discontinue that charge now)
- Audit what other E5 features you’re not currently using—there’s substantial capability in E5 that many organizations don’t leverage
- Consider whether some users could downgrade to E3 if they don’t need the advanced features
If You’re on E3 and Considering E5
- Don’t upgrade solely for Security Copilot unless you have security staff ready to use it
- Do upgrade if you need the broader E5 security, compliance, and management suite
- Calculate the per-user cost difference (typically $20-30 more per user per month for E5 vs. E3)
- Audit which E5 features you would actually use versus what you’re paying for
- Consider a hybrid licensing approach: E5 for executives and IT/security staff, E3 for general users
If You’re on Business Premium
- E5 represents a significant jump—probably not worth it unless you’re scaling substantially or have specific enterprise needs
- Focus on fully utilizing Business Premium’s security features before considering upgrades
- Make sure you’re using Defender for Office, device management, and conditional access effectively
- If you need specific E5 capabilities, consider whether a hybrid approach (Business Premium for most users, E5 for specific roles) makes sense
The Bigger Picture: Microsoft’s AI Strategy
Security Copilot’s inclusion in E5 is part of Microsoft’s broader strategic push to make AI capabilities pervasive across the Microsoft 365 ecosystem. Copilot features are being embedded everywhere: Word, Excel, PowerPoint, Outlook, Teams, security tools, compliance platforms, and administrative interfaces.
What this trend means for businesses:
- AI capabilities are rapidly moving from premium features to table stakes—baseline expectations rather than differentiators
- Microsoft is increasingly differentiating license tiers based on AI capability access rather than just app access
- Features that are standalone add-ons today will likely become tier inclusions tomorrow (Security Copilot follows this pattern)
- You’ll increasingly pay for integration, orchestration, and advanced AI rather than basic AI access
- The licensing landscape will continue to shift—what’s in which tier will evolve
Strategic consideration: As Microsoft bundles more AI capabilities into higher license tiers, the value proposition of those tiers increases—but so does the complexity and the expertise required to extract that value. Make sure you have the organizational capability (people, processes, training) to actually use what you’re paying for. Unused licenses are wasted budget regardless of how much capability they theoretically provide.
When to Get Professional Help
Microsoft 365 licensing is notoriously complex, and it gets more complicated with every new feature release and tier adjustment. Here are signs you should get independent professional guidance:
- You’re not certain what license tier you’re currently on or why
- You have a mix of different license types across users and aren’t sure whether that’s optimal
- You’re paying for add-ons that might now be included in your base licenses
- You want to understand whether E5 makes financial and operational sense but can’t parse Microsoft’s licensing documentation
- You’re being pressured by Microsoft sales or your reseller to upgrade but want an independent perspective
- Your licensing costs keep increasing but you’re not sure what you’re getting for that increase
- You suspect you’re over-licensed (paying for capabilities you don’t use) or under-licensed (missing capabilities you need)
Licensing consultations from someone who isn’t selling you Microsoft licenses—and thus has no incentive to push you toward more expensive tiers—can pay for themselves in avoided overspending or optimized license allocation.
The Bottom Line
Microsoft Security Copilot is now included in E5 licenses as of April 20, 2026. This is positive news for current E5 customers and adds value to that licensing tier. For organizations considering whether to upgrade from E3 to E5, Security Copilot is a worthwhile bonus but shouldn’t be the primary decision driver.
The fundamental E3-vs-E5 calculation remains the same: Do you need the advanced security, compliance, and management capabilities that E5 provides, and do you have the expertise to leverage them effectively? If yes, E5 makes sense and Security Copilot is a valuable addition. If no, stay on E3 or Business Premium and focus on fully utilizing what those tiers already offer.
Microsoft’s new E7 Frontier Suite is aimed at large enterprises and is almost certainly overkill for small and medium businesses.
The broader trend is clear: AI capabilities are becoming pervasive across Microsoft 365, and Microsoft is using AI access to differentiate license tiers. Make sure you’re getting value from the licenses you pay for, not just paying for theoretical capabilities you’ll never effectively use.
Get Independent Guidance on Microsoft Licensing
Not sure whether Microsoft 365 E5 and Security Copilot make sense for your business? Castle Rock Sky helps businesses across the Denver metro and Front Range navigate Microsoft licensing decisions with independent advice—not sales pitches.
We’ll audit what you’re currently paying for, what you actually need, and whether upgrades make financial and operational sense for your specific situation. No vendor incentives, no pressure to over-buy—just honest assessment of what serves your business best.
Let’s make sure you’re getting value from your Microsoft 365 investment
