Manage usage of security compute units in Security Copilot
The usage monitoring dashboard provides a comprehensive view into various data dimensions to help you keep track of security compute unit usage in Security Copilot. You'll have visibility into the number of units used, the specific plugins employed during sessions, and the initiators of those sessions. The dashboard also allows you to apply filters and export usage data seamlessly. The dashboard includes up to 90 days of data, offering a robust window into recent activity.
How provisioned SCUs are billed
Copilot for Security is sold in a provisioned capacity model and is billed by the hour. You can provision Security Compute Units (SCUs) and increase or decrease them at any time. Billing is calculated on hourly blocks rather than by 60-minute increments and has a minimum of one hour. Any usage within the same hour is billed as a full SCU, regardless of start or end times within that hour. For instance, if you provision an SCU at 9:05 am, then deprovision it at 9:35 am, and then provision another SCU at 9:45 am, you'll be charged for two units within the 9:00 a.m. to 10:00 a.m. hour. Similarly, if you provision an SCU at 9:45 a.m., you'll only have 15 minutes to use it before it's no longer available, as SCUs are provided in hourly blocks from 9:00 a.m. to 10:00 a.m. To maximize usage, make SCU provisioning changes at the beginning of the hour. For more information, see Manage usage.
Monitor security compute units use
Copilot owners can view the usage over time within the Microsoft Security Copilot usage monitoring dashboard.
To view the usage dashboard:
Sign in to Security Copilot (https://securitycopilot.microsoft.com) and go to the Home menu > Owner settings.
Select Usage monitoring.
View the usage dashboard, which shows how many SCUs are consumed over a period of time by your Microsoft Security Copilot workloads.
Understand the data dimensions
Use the data dimensions to get a granular view of how SCUs are being used. The following table provides information on what each column represents and helps you interpret data accurately:
| Column | Description | Examples/Types |
|---|---|---|
| Date | Date when the user initiated the session. Displayed in local time zone. | Sept 10, 08:30 AM |
| Units used | Number of SCUs used in the session. | .6 |
| Initiated by | The user that initiated the session. | Ben Heppard |
| Session ID | A unique identifier for each Copilot session. | a123b456-789-1011-1c2-d12345678e99 |
| Category | The format in which session was made. There are two category types: - Prompt - Promptbook |
Prompt – A single prompt. Promptbook – A session related to a promptbook. For example, a user initiates "Script Analysis" promptbooks in which 5 prompts are called. Each prompt from promptbook call will have a category as "promptbook". |
| Type | The method used for the session. There are two invocation types: - Manual Action - Automated Action. |
Manual Action – User triggered calls. A user must manually initiate. For example, a user types and submits prompt in prompt bar. Automated Action - Calls that are automatically initiated/scheduled. For example, incident summary, scheduled logic app, or scheduled promptbook. |
| Copilot experience | The user interface where the session was initiated from. Users can use the standalone interface, an embedded interface, or through LogicApps. | - Security Copilot portal (Standalone experience) - Copilot in Microsoft products (Embedded experience), for example, inside Microsoft Defender XDR. - Azure Logic Apps - Users can initiate Security Copilot workflows using Azure Logic Apps. |
| Plugin used | The plugin used in the session. | Microsoft Entra |
Apply filters
Use filters to narrow down the displayed information in the dashboard. Applying filters can help you analyze relevant data without reviewing the entire data set.
Note
Currently, filters are only applied to the table and not the bar-graph.
The following filters are available:
- Copilot experience
- Users
- Plugins used
- Type
- Category
Important
Selecting a date range impacts the data shown in the table. For instance, choosing "Last 24 hours" and then selecting a filter, such as a specific user will display information related to that user from only the past 24 hours.
Selecting a bar in the graph filters the table to show information for that specific day.
Export data
Export usage dashboard data into Excel files for easier analysis, sharing, or offline access. Select the Export button on the corner of the dashboard.
Nearing and crossing security compute unit limit
When the usage in your organization is nearing the limit, you are notified of it when submitting the prompts. To avoid disruption, you can contact the Azure capacity owner or contributor to increase the security compute units or limit the number of prompts.
Experience when nearing security compute unit limit
When an analyst is in the middle of an investigation and the usage is nearing the provisioned capacity limit, a notification is displayed to the analyst in response to a prompt.
These notifications are also shown in Security Copilot embedded experiences.
The notification informs the analyst to contact the Azure capacity owner or contributor to increase the capacity or limit the number of prompts to avoid disruptions.
The notification allows the analyst to react before they run out of capacity.
Experience when security compute unit limit is exceeded
When the provisioned security compute unit is crossed, the analyst will see an error message stating that due to high usage in the organization Copilot can't respond to requests. Analysts can't submit additional prompts at this time. More capacity would become available in the next hour.
The analyst is asked to contact the Azure capacity owner or contributor to increase the provisioned SCUs.
This view only appears when your organization reaches 100% of capacity.
Update the provisioned security compute units (SCUs)
You can update provisioned security compute units in the Azure portal as well as the Security Copilot portal.
Azure portal required role: Azure capacity owner or contributor
Security Copilot portal required role: Azure capacity owner or contributor who are also Security Copilot owners.
Note
Users can expect capacity adjustments to take effect within 30 minutes.
Updating units in the Security Copilot portal
Sign in to Security Copilot (https://securitycopilot.microsoft.com) and go Settings.
Select Owner settings.
Under Security compute units, select Change. Update the number of provisioned security compute units (SCUs).
As the number of SCUs are increased or decreased, the estimated monthly cost changes accordingly, assuming the provisioned capacity remains the same 24 hours a day for the whole month.
Handle capacity for features
Public preview and GA capability usage is charged against SCUs while Private preview capability usage is not.