Allocating SCUs for Security Copilot – SC-200 Study Guide

Purpose of This Lesson

Microsoft Security Copilot uses provisioned Security Compute Units (SCUs) to provide processing capacity. This lesson focuses on creating that capacity, selecting the Azure resources and locations it uses, connecting it to a workspace, and controlling costs by deleting it when it is no longer needed.

For SC-200 purposes, the important skill is not memorizing a portal walkthrough. It is understanding the resource lifecycle and making safe operational decisions when enabling a metered security service.

Key Concepts

Security Compute Units

SCUs provide the compute capacity used by Microsoft Security Copilot. The number of units affects the capacity allocated to the service and contributes to consumption-based charges.

The exact price depends on factors such as region, agreement, and current Microsoft pricing. Treat any portal estimate or course example as time-sensitive rather than as a permanent price guarantee.

Azure subscription and resource group

A capacity must be associated with an Azure subscription and stored in an Azure resource group. A resource group is a logical container for Azure resources; it is not itself the compute capacity.

The resource group supports resource organization, access control, lifecycle management, and cleanup. Naming it clearly helps administrators identify learning, development, or production resources.

Capacity name and workspace

The capacity name identifies the Security Copilot capacity resource. The selected workspace represents the Copilot environment or project that uses the capacity.

A default workspace may be sufficient for a simple evaluation. Separate workspaces can be useful when activities or projects need logical separation, subject to the organization’s governance and access model.

Capacity region and prompt evaluation location

The capacity region is where the provisioned capacity is hosted. It should be selected according to organizational requirements, availability, and proximity to users or connected services.

The prompt evaluation location controls where Copilot evaluates prompts. Allowing evaluation in other regions may improve availability or performance, but it can have data-residency, privacy, or regulatory implications. This option should be reviewed against organizational policy rather than enabled automatically.

Capacity lifecycle

Creating a capacity starts a metered service. Deleting it stops that capacity from continuing to incur charges. Pausing a browser session or leaving the Copilot portal does not necessarily stop billing.

A safe lifecycle is:

1. Identify the hands-on activities that require Copilot.
2. Create the capacity with the required region, workspace, and unit count.
3. Record the creation time and monitor usage.
4. Perform the planned work.
5. Delete the capacity when it is no longer required.
6. Recreate it later if another session is needed.

Microsoft Security Operations Context

Security Copilot can support investigation and response activities across Microsoft security products, but allocating SCUs is an administrative and financial control rather than an alert-triage action.

In a production SOC, capacity planning should be coordinated with the Security Copilot administrator, Azure subscription owner, procurement or FinOps team, and data-governance stakeholders. The analyst may use Copilot, while a separate administrator controls capacity, permissions, regions, and cost boundaries.

The capacity decision should account for:

• Expected analyst or automation workload.
• Required workspace and role assignments.
• Regional and data-handling requirements.
• Budget and chargeback ownership.
• A documented cleanup process for temporary environments.
• Change control for production capacity changes.

Exam-Relevant Takeaways

• Security Copilot capacity is provisioned through Security Compute Units (SCUs).
• Capacity creation requires an Azure subscription and resource group.
• The resource group is a container for Azure resources; it is not the same thing as a workspace.
• Capacity can be created from the Security Copilot experience or through the Azure portal using Microsoft Security compute capacity resources.
• Capacity units are metered. Leaving a capacity running can continue generating charges even when nobody is actively using the portal.
• Capacity region and prompt evaluation location are separate configuration choices.
• Allowing prompt evaluation outside the selected location can affect data-residency and governance decisions.
• Deleting an unused capacity is the primary cleanup action demonstrated in this lesson.
• Microsoft support may sometimes help with accidental resource charges, but a refund should never be treated as guaranteed. Prevention and monitoring remain the correct operational practice.

Tool / Feature Decision Guide

Situation	Appropriate decision	Reason
A short training exercise needs Security Copilot	Create the required capacity, use it for the planned work, then delete it	Limits the time that metered capacity remains active
Several projects require logical separation	Consider separate workspaces	Provides project-oriented separation, subject to governance and permissions
The organization has data-residency requirements	Select approved capacity and prompt-evaluation locations	Location choices can affect where prompts are evaluated and must match policy
The administrator prefers Azure resource governance	Create or manage the capacity in the Azure portal	Uses standard subscription, resource-group, access, and lifecycle controls
Work is paused temporarily	Check the capacity status and billing implications; delete it if it is not needed	Closing a tab or stopping active use may not stop capacity charges
A capacity was created by mistake	Delete it promptly and document the event	Reduces further cost exposure; support assistance is not guaranteed

Common Exam Traps

• Confusing SCUs with a workspace: SCUs are provisioned compute capacity; a workspace is the Copilot environment or project association.
• Assuming portal inactivity stops charges: A provisioned capacity can remain billable even when no analyst is interacting with it.
• Treating the capacity region and evaluation location as the same setting: They are distinct choices with potentially different governance consequences.
• Assuming a default workspace is always the best choice: It may be adequate for a basic exercise, but project or organizational separation may require another workspace.
• Relying on support for refunds: Accidental-charge assistance may be available, but it is not a substitute for cost controls, alerts, and cleanup.
• Assuming the course’s price is an exam fact: Pricing changes and depends on commercial context. Focus on the metered-capacity concept and lifecycle management.

Real-World SOC Analyst Notes

• Record who created a capacity, why it was created, which subscription and resource group contain it, and when it should be removed.
• Use naming conventions that identify environment and owner, such as a training or test designation, rather than ambiguous names.
• Apply least privilege. The ability to investigate incidents with Copilot does not automatically require permission to create or delete Azure resources.
• Use Azure cost controls, budgets, alerts, and resource governance where available. Do not depend solely on memory or manual timing.
• Treat prompt-evaluation location as a security and compliance decision, not merely a performance setting.
• Before deleting a production capacity, confirm that no other users, workflows, or investigations depend on it. Preserve required investigation notes and evidence separately.
• Coordinate temporary training resources with the subscription owner so that deletion, access, and cost ownership are clear.

Quick Reference Summary

• SCU: Metered Security Copilot compute capacity.
• Subscription: Azure billing and resource-management boundary used for the capacity.
• Resource group: Container that holds the capacity resource.
• Workspace: Copilot environment or project association.
• Capacity region: Region selected for the provisioned capacity.
• Prompt evaluation location: Location or locations where prompts are evaluated.
• Cleanup action: Delete the capacity when it is no longer needed.
• Operational priority: Control cost, location, permissions, and lifecycle before enabling hands-on use.

Flashcards

Q: What must be selected before creating a Security Copilot capacity?
A: An Azure subscription and a resource group must be specified. The capacity is stored as an Azure resource in that resource group.

Q: Why should an analyst record the time a temporary SCU capacity is created?
A: Capacity usage is metered over time, so recording creation time helps the team monitor cost and decide when cleanup is required.

Q: What is the correct action when a training session ends and the capacity is no longer needed?
A: Delete the capacity. Closing the browser or leaving the Copilot portal does not reliably end the capacity’s billing lifecycle.

Q: When might separate Security Copilot workspaces be preferable to the default workspace?
A: They may be preferable when different projects or activities require logical separation. The choice should also consider permissions, governance, and administration.

Q: How does a resource group differ from a Security Copilot workspace?
A: A resource group is an Azure container for resources and supports Azure management. A workspace is the Copilot environment or project association that uses the capacity.

Q: What is the exam-relevant difference between capacity region and prompt evaluation location?
A: Capacity region identifies where the capacity is hosted, while prompt evaluation location identifies where prompts are evaluated. They should be assessed separately for performance and data-governance requirements.

Q: Which option should receive priority when an organization has strict data-residency requirements?
A: Choose capacity and prompt-evaluation locations approved by the organization’s data-governance policy, even if a broader location option might improve availability.

Q: An analyst needs Copilot for one hour and then will resume work next week. What is the cost-control decision?
A: Use the capacity for the planned session and delete it afterward, then recreate it when needed. Leaving it provisioned between sessions can create unnecessary charges.

Q: Can Security Copilot capacity be created only from the Security Copilot website?
A: No. The lesson demonstrates creation through the Security Copilot experience and management through the Azure portal; both ultimately provision an Azure-backed resource.

Q: What is the safest response to an accidentally created capacity?
A: Delete it promptly, document what happened, and notify the resource or subscription owner. Microsoft support may help in some cases, but a refund is not guaranteed.

Q: Why is least privilege relevant to SCU allocation?
A: Using Copilot for investigations does not mean every analyst should be allowed to create or delete Azure capacity. Resource-management permissions should be limited to authorized administrators.

Q: What should be checked before deleting a capacity in a shared environment?
A: Confirm that no users, investigations, or dependent activities still need it, and preserve any required notes or evidence before removal.

Practice Questions

Question 1

A SOC analyst finishes a Security Copilot lab and closes the browser. The Azure capacity remains provisioned. What is the best next action?

A. Leave it running because no prompts are being submitted
B. Delete the capacity if it is no longer required
C. Delete only the workspace
D. Change the prompt evaluation location

Correct answer: B. A provisioned capacity can continue incurring metered charges even when the portal is closed and no active prompts are being submitted. Deleting the unused capacity is the appropriate cleanup action.

Question 2

A company requires prompts to be evaluated only in approved geographic locations. Which configuration should the administrator review most directly?

A. Resource-group name
B. Capacity name
C. Prompt evaluation location
D. Workspace display name

Correct answer: C. Prompt evaluation location determines where Copilot evaluates prompts. It must align with the organization’s data-residency and compliance requirements.

Question 3

An administrator wants to provision Security Copilot capacity using standard Azure governance and billing controls. Which approach is supported by the lesson?

A. Create the capacity through the Azure portal and associate it with a subscription and resource group
B. Create a Microsoft Sentinel analytics rule
C. Add a Defender for Endpoint device group
D. Create a Defender XDR incident

Correct answer: A. Security Copilot capacity can be created or managed through Azure using the relevant Microsoft Security compute capacity resource. Subscription and resource-group selection are part of the process.

Question 4

A training team wants separate Copilot environments for unrelated projects. What is the most appropriate consideration?

A. Increase the SCU count without changing any environment settings
B. Use separate workspaces if project separation is required and supported by governance
C. Create a new Azure region for every prompt
D. Delete the Azure subscription after each project

Correct answer: B. Workspaces can provide logical separation for different activities or projects. The design should also account for permissions, administration, and cost.

Question 5

A learner accidentally leaves a capacity running overnight and plans to rely on Microsoft support for a refund. Which statement is most accurate?

A. Refunds are automatic for educational tenants
B. Support may provide assistance, but the learner should not assume a refund is guaranteed
C. Deleting the capacity automatically reverses all prior charges
D. The capacity is free until a prompt is submitted

Correct answer: B. Support may sometimes help with accidental resource charges, but prevention, monitoring, and prompt deletion are the reliable controls. Deletion stops future capacity use; it does not inherently erase prior charges.