Microsoft Copilot for Security: General Availability details

Examples of what a user did and how that effects cost might help.

I did a quick test of Copilot for Security two days ago by setting up the Copilot and an azure resource of 1 SCU. I did some queries (working about 5 minutes) and waited for some time and then deleted that resource.

I was billed about 2 € for that experiment. The Copilot was ready to run at the point in time when I assigned the SCU to my Copilot.

My conclusion:

• A SCU is like a VM in a VM Scale Set. You pay for the time the VMs are running - without considerations whether you are working with these VMs or not.
• You can scale up and down to influence the cost (and the response time). The more SCUs you add, the more performance you will get and the more you will pay.
• You (currently) cannot scale down to 0 - instead, you need to delete the Azure resource representing your SCUs. That's a bad thing, because this adds additional steps to reduce cost in users/teams that are not operating 24x7.

So: you can start working with Copilot for Security without having to commit a 2880,- US$ bill for one month (= 1 SCU 24x7 for 30 days) by manually creating/deleting the Azure Resource for Copilot for Security. This can also be automated, but assigning that resource to your copilot seems to be a manual step.

Starting with Copilot for Security just for testing, I would automate the creation of the Azure resource and set up a simple Azure Automation that deletes the resource each day at 17:00 - just to be sure to not have that heavy bill at the end of the month without using it.

When you have a security team that is using the Copilot 24x7, the additional cost of 2880,- US$ for one month of one SCU might not be an issue for you and the benefit of using Copilot for Security instead of clicking through all the other security product GUIs will generate a huge ROI.