Manage security compute unit usage in Security Copilot

The usage monitoring dashboard provides a comprehensive view into various data dimensions to help you keep track of security compute unit usage in Security Copilot. You'll have visibility into the number of provisioned and overage units used in workspaces, the specific plugins employed during sessions, and the initiators of those sessions. The dashboard also allows you to apply filters and export usage data seamlessly. The dashboard includes up to 90 days of data, offering a robust window into recent activity.

How provisioned and overage SCUs are billed

Security Copilot operates on a provisioned and overage capacity. Provisioned capacity is billed by the hour while the overage capacity is billed on usage.

You can flexibly provision Security Compute Units (SCUs) to accommodate regular workloads and adjust them anytime without long-term commitments.

To manage unexpected demand spikes, you can set an overage amount to ensure that additional SCUs are available when initially provisioned units are depleted during unexpected workload spikes. Overage units are billed on-demand and can be set as unlimited or a maximum amount. This approach enables predictable billing while providing the flexibility to handle both regular and unexpected usage.

Billing is calculated on hourly blocks based on provisioned capacity rather than by 60-minute increments and has a minimum of one hour. Any usage consumed within the same hour is billed as a full SCU for provisioned capacity, regardless of start or end times within that hour. For overage units, SCUs are billed up to one decimal increments for the exact consumed units. Consumed units are not rounded up to whole numbers. This means that you're charged precisely based on your usage (to one decimal place).

For instance, if you provision an SCU at 9:05 a.m., then deprovision it at 9:35 am, and then provision another SCU at 9:45 am, you'll be charged for two units within the 9:00 a.m. to 10:00 a.m. hour. To maximize usage, make SCU provisioning changes at the beginning of the hour. For more information, see Manage usage.

For more information, see Microsoft Security Copilot pricing and the Pricing calculator page.

Example billing scenarios for overages

This section provides some scenarios to illustrate how overages are billed.

An enterprise company provisioned 4 SCUs and set an overage limit of 6 SCUs to stay within the monthly budget.

• Scenario 1:

  • A user runs a prompt consuming 3 SCUs and uses the incident summarization in Defender consuming 0.5 SCU.
  • The total consumption is calculated as 3.5 SCUs. However, the charge for that hour will be based on 4 provisioned SCUs.

  Activity	SCU consumed
  Runs a prompt	3.0 SCUs
  Uses incident feature	0.5 SCU
  Total Consumption	3.5 SCUs

• Scenario 2:

  • Building on Scenario 1, a user also runs a promptbook consuming an additional 3.7 SCUs, bringing the total to 7.2 SCUs for the hour.
  • The charge for that hour will now be based on 4 provisioned SCUs, and 3.2 overage SCUs.

  Activity	SCU consumed
  Runs a prompt	3.0 SCUs
  Uses incident feature	0.5 SCU
  Runs a promptbook	3.7 SCUs
  Total Consumption	7.2 SCUs

Monitor security compute units use

Copilot owners can view the usage over time within the Microsoft Security Copilot usage monitoring dashboard.

To view the usage dashboard:

1. Sign in to Security Copilot (https://securitycopilot.microsoft.com) and go to the Home menu > Owner settings.

2. Select Usage monitoring.

3. View the usage dashboard, which shows how many SCUs are consumed over a period of time by your Microsoft Security Copilot workloads.

Understand the data dimensions

Use the data dimensions to get a granular view of how SCUs are being used.

Capacities are captured on the tabs at the top of the dashboard. Select a capacity to view the usage information related to that specific capacity.

You'll see information such as provisioned units used, overage units units used, and the workspace that's using the capacity.

The following table provides information on what each column represents and helps you interpret data accurately:

Apply filters

Use filters to narrow down the displayed information in the dashboard. Applying filters can help you analyze relevant data without reviewing the entire data set.

The following filters are available:

• Copilot experience
• Users
• Plugins used
• Type
• Category

Selecting a bar in the graph filters the table to show information for that specific day.

Export data

Export usage dashboard data into Excel files for easier analysis, sharing, or offline access. Select the Export button on the corner of the dashboard.

Nearing and crossing security compute unit limit

When the usage in your organization is nearing the limit, you are notified of it when submitting the prompts. To avoid disruption, you can contact the Azure capacity owner or contributor to increase the security compute units or limit the number of prompts.

Experience when nearing security compute unit limit

When an analyst is in the middle of an investigation and the usage is nearing the provisioned capacity limit, a notification is displayed to the analyst in response to a prompt.

These notifications are also shown in Security Copilot embedded experiences.

The notification informs the analyst to contact the Azure capacity owner or contributor to increase the capacity or limit the number of prompts to avoid disruptions.

The notification allows the analyst to react before they run out of capacity.

Experience when security compute unit limit is exceeded

When the provisioned and overage security compute unit is crossed, the analyst will see an error message stating that due to high usage in the organization Copilot can't respond to requests. Analysts can't submit additional prompts at this time. More capacity would become available in the next hour.

The analyst is asked to contact the Azure capacity owner or contributor to increase the provisioned SCUs.

This view only appears when your organization reaches 100% of capacity.

Update the provisioned and overage security compute units (SCUs)

You can update provisioned security compute units and overage units in the Azure portal as well as the Security Copilot portal. You also have the option to view billing in Azure while updating SCUs.

Azure portal required role: Azure capacity owner or contributor

Security Copilot portal required role: Azure capacity owner or contributor who are also Security Copilot owners.

Updating provisioned and overage security compute units (SCUs)

1. Sign in to Security Copilot (https://securitycopilot.microsoft.com) and go Settings.

2. There are two ways you can update the provisioned and overage SCUs:

   • Through the owner settings page: Under Security compute units or Number of overage units, select Change.
   • Through the usage dashboard: Select Change units in the main dashboard.

   In either option, update the number of security compute units (SCUs) for the provisioned and overage units. You also have the option to view billing in Azure by selecting View billing in Azure.

   As the number of SCUs are increased or decreased, the estimated monthly cost changes accordingly, assuming the provisioned capacity remains the same 24 hours a day for the whole month.

Handle capacity for features

Public preview and GA capability usage is charged against SCUs while Private preview capability usage is not.