Forum Discussion
Feature Request: Manual Invocation Mode for Embedded Security Copilot Experiences to reduce cost !
Hello, I see that Copilot for Security in XDR dashboards , if used in embedded mode (I mean whenever you are opening a case to investigate) you get AUTOMATICALLY a summary of the incident , and you are consuming SCU costs.
I want a way either globally as a tenant option, or through a pwsh to be able to DISABLE this, or be able to PRESS the AI button AND THEN generate the AI reply (and consume SCU credits ..)
Current behavior:
Open Incident --> Copilot automatically generates Incident Summary --> SCUs ARE consumed
Desired behavior:
Open Incident --> No AI execution --> Click "Generate Summary" MANUALLY --> SCUs consumed
I am not talking about RBAC controls to assign WHO of my admins can use Security Copilot, I have set that, BUT I want my admin to decide IF they want AI to help them (and consume - pay for that SCU credits-costs) OR NOT !!
At the moment I havent found any solution, except to educate my admin to press CANCEL the moment he/she opens such an XDR dashboard ! :)
Does anyone knows something ?
Regards, Panos
1 Reply
I agree with the point here. RBAC controls who can use Security Copilot, but cost control also needs a separate "run only when I click" option. Until Microsoft adds that tenant-level switch, the safest workaround is to limit Copilot access to the admins who really need it and raise this as product feedback through support or the feedback portal.
