Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Microsoft Security Copilot is a generative AI security product that empowers security and IT professionals to respond to cyber threats, process signals, and assess risk exposure at the speed and scale of AI. For an overview, see What is Security Copilot?.
This topic helps you:
- Understand what Security Compute Units (SCUs) are
- Determine if you need to purchase SCUs
- Choose the right onboarding path based on your license
- Access resources for provisioning SCUs
Note
Disclaimer: This documentation is only intended for customers using commercial clouds. Currently, Security Copilot is not designed for use by customers using US government clouds, including but not limited to GCC, GCC High, DoD, and Microsoft Azure Government. For more information, consult with your Microsoft representative.
Security compute units
Security Compute Units (SCUs) represent the compute capacity required to run Security Copilot workloads. Security compute units are the required units of resources that are needed for dependable and consistent performance of Microsoft Security Copilot.
Depending on your scenario, you may need to purchase SCUs to use Security Copilot. Use the following section to determine which onboarding path applies to you.
Security Copilot operates on a provisioned capacity and an overage capacity. Provisioned capacity is billed by the hour while the overage capacity is billed on usage.
You can flexibly provision Security Compute Units (SCUs) to accommodate regular workloads and adjust them anytime without long-term commitments.
Some products rely on SCUs to operate their features. You can purchase SCUs for those features, but those SCUs are exclusively applicable to the designated service and cannot be used to access the Security Copilot portal.
To manage unexpected demand spikes, you can allocate an overage amount to ensure that additional SCUs are available when initially provisioned units are depleted during unexpected workload spikes. Overage units are billed on-demand and can be set as unlimited or a maximum amount. This approach enables predictable billing while providing the flexibility to handle both regular and unexpected usage.
Billing is calculated on hourly blocks based on provisioned capacity rather than by 60-minute increments and has a minimum of one hour. Any usage consumed within the same hour is billed as a full SCU for provisioned capacity, regardless of start or end times within that hour. For overage units, SCUs are billed up to one decimal increments for the consumed units.
For instance, if you provision an SCU at 9:05 a.m., then deprovision it at 9:35 am, and then provision another SCU at 9:45 am, you'll be charged for two units within the 9:00 a.m. to 10:00 a.m. hour. To maximize usage, make SCU provisioning changes at the beginning of the hour. For more information, see Manage usage.
For more information, see Microsoft Security Copilot pricing and the Pricing calculator page.
Capacity
Capacity in the context of Security Copilot, is an Azure resource that contains SCUs. SCUs are provisioned for Security Copilot. You can easily manage capacity by increasing or decreasing provisioned SCUs within the Azure portal or the Security Copilot portal. Security Copilot provides a usage monitoring dashboard for Copilot owners, allowing them to track usage over time and make informed decisions about capacity provisioning. For more information, see Managing usage.
Which onboarding path applies to you?
If your organization’s license includes Security Copilot (for example, through Microsoft 365 E5 or other bundled offers), you may not need to purchase or provision SCUs separately. Otherwise, you’ll need to provision SCUs to enable Security Copilot.
| Scenario | Do I need to purchase SCUs? | Next Steps |
|---|---|---|
| Security Copilot is included in my license | No | Proceed to access Security Copilot. SCUs are bundled. See Access Security Copilot. |
| Security Copilot not included in my license | Yes | See Provisioning and managing SCUs |
| Unsure | Contact your Microsoft representative or see Understand Security Copilot in Microsoft 365 E5 |
Onboarding to Security Copilot
Access Security Copilot
If Security Copilot is included in your license, you can immediately proceed to access Security Copilot. You have the option of accessing the Security Copilot portal directly at: (https://securitycopilot.microsoft.com).
Security Copilot is also available as embedded experiences in multiple Microsoft Security products. For more information, see Security Copilot experiences. From any of the embedded experiences, access Security Copilot through sidecar experiences.
For more information on Security Copilot capabilities included in your license, see Understand Security Copilot in Microsoft 365 E5.
Provisioning SCUs
If Security Copilot is not included your license, you'll need to provision SCUs.
You can choose from the following options to provision capacity:
- Option 1 (Recommended): Provision capacity within Security Copilot
- Option 2: Provision capacity through Azure
Note
Regardless of the method you choose, you will need to purchase a minimum of 1 provisioned SCU. You can purchase up to a maximum of 100 SCUs. The recommended number of units to conduct an introductory exploration of Security Copilot is 3 units with overage set to unlimited overage. You can use the usage monitoring dashboard to keep track of usage and adjust capacity based on workload. For more information, see Manage usage.
Minimum requirements
- Azure subscription: Required to purchase SCUs. Create your free Azure account.
- Supported roles: Anyone with a supported Microsoft Entra or Microsoft Purview role can complete onboarding steps.
Note
Whoever sets up the default environment (including any other owner roles that that person holds) will be designated as the default owner. For example if the person setting up Security Copilot has and Entra Compliance Administrator role and Purview Organization Management role, then both of those roles are added as owners by default.
Option 1 (Recommended): Provision capacity through Security Copilot
When you first open Security Copilot (https://securitycopilot.microsoft.com), you're guided through the steps in setting up capacity for your organization.
Sign in to Security Copilot (https://securitycopilot.microsoft.com).
Select Get started.
Set up a workspace. A workspace is a scoped, tenant-bound environment where users, automations, and agents operate. Enter a workspace name following the workspace naming convention, then select Continue. For more information, see Naming rules and restrictions for Azure resources.
Set up your security capacity:
Select the Azure subscription, associate capacity to a resource group, add a name to the capacity, select the prompt evaluation location, and specify the number of Security Compute Units (SCUs). You can also specify the number of overage units. These units offer the flexibility to have additional security compute units available when the initially provisioned SCUs are depleted during usage spikes.
Note
The number of SCUs is provisioned on an hourly basis, and the estimated monthly cost is displayed.
If your selected geo location is too busy, you can also evaluate the prompts anywhere in the world. This can be done by selecting the appropriate option in the capacity creation screen.
Select among the data sharing options. Select Continue. For more information on data sharing, see Privacy and data security.
Confirm that you acknowledge and agree to the terms and conditions, then select Continue.
After you've created the capacity, it will take a few minutes to deploy the Azure resource on the backend.
Select if you want Security Copilot to capture and store admin actions, user actions, and system responses. Select Continue. For more information, see Accessing data from Microsoft 365 services.
Note
Microsoft Purview will store your Customer Data in the region where your Microsoft 365 data is stored. For more information, see Privacy and data security.
Review the roles that can access Security Copilot. You can choose to select other recommended owner roles or add contributors. Select Continue.
A confirmation page is displayed. Select Finish.
Option 2: Provision capacity in Azure
The initial setup in this method starts in the Azure portal. Then, you need to complete the setup in the Security Copilot portal.
Note
Billing begins as soon as capacity is created, regardless of whether the SCU is attached to an environment.
Sign in to the Azure portal.
Search for Security compute in the list of services, then select Microsoft Security compute capacities.
Select Resource groups.
Under Plan, select Microsoft Security Copilot. Then select Create.
Select a subscription and resource group, add a name to the capacity, select the prompt evaluation location and select the number of Security Compute Units (SCUs). You can also specify the number of overage units. These units offer the flexibility to have additional security compute units available when the initially provisioned SCUs are depleted during usage spikes. Data is always stored in your home tenant geo.
Note
The number of SCUs is provisioned on an hourly basis, and the estimated monthly cost is displayed.
If your selected geo location is too busy, you can also evaluate the prompts anywhere in the world. This can be done by selecting the appropriate option in the capacity creation screen.
Confirm that you acknowledge and have read the terms and conditions, then select Review + create.
Verify that all the information is correct, then select Create. A confirmation page is displayed.
Select Finish setup in the Security Copilot portal.
Recommended next steps
- Assign roles to users
- Try out standalone and embedded experiences
- Learn about integrations
- Check out primary use cases
- Join the Microsoft Security Copilot Customer Connection Program (CCP)