An organization's security team wants to understand which Microsoft Copilot for Security capabilities require Security Compute Units (SCUs) versus which are included in existing Microsoft licenses. A new analyst asks about the billing model. What is the correct understanding?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because the Microsoft Copilot for Security standalone experience (the dedicated portal at securitycopilot.microsoft.com) requires provisioned Security Compute Units (SCUs). However, embedded Copilot experiences within specific Microsoft security products (such as embedded Copilot in Microsoft Defender XDR or Microsoft Intune) may be available as part of those product licenses without additional SCU consumption.
Full explanation below image
Full Explanation
B is correct because the Microsoft Copilot for Security standalone experience (the dedicated portal at securitycopilot.microsoft.com) requires provisioned Security Compute Units (SCUs). However, embedded Copilot experiences within specific Microsoft security products (such as embedded Copilot in Microsoft Defender XDR or Microsoft Intune) may be available as part of those product licenses without additional SCU consumption. A is incorrect because Copilot for Security standalone requires SCU provisioning regardless of E5 licensing. C is incorrect because the billing model is based on SCUs (capacity-based), not per-user-per-month licensing. D is incorrect because SCUs are consumed by all Copilot for Security queries, not only queries to external threat intelligence sources.