Microsoft Security Copilot capacity (Security Compute Units) is provisioned in the tenant

Overview

Microsoft Security Copilot is a generative AI assistant that compresses analyst triage time by summarizing incidents, scripts, and entity context across Microsoft Defender, Microsoft Sentinel, Microsoft Entra, Microsoft Intune, and Microsoft Purview. The service runs only when the tenant has at least one provisioned Security Compute Unit (SCU) capacity attached to a workspace; without a capacity, neither the standalone portal nor the embedded “Ask Copilot” experiences in Defender XDR are available, and SOC analysts fall back to manual investigation. From a kill-chain perspective, slower analyst workflow is a defender-velocity gap: once a threat actor lands Initial Access, they iterate quickly through Discovery, Credential Access, Lateral Movement, Collection, and Exfiltration; every additional minute of mean-time-to-respond (MTTR) extends the dwell window in which those tactics can complete. Provisioning SCUs is the prerequisite that unlocks AI-assisted triage and is therefore the gating control for every downstream Security Copilot best practice (incident summarization, guided response, script analysis, identity and device review).

Remediation

• Onboarding to Security Copilot for non-Microsoft 365 E5 customers
• Learn about Security Copilot for Microsoft 365 E5 included customers

Run it

The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:

Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn

Leave out -SkipBuiltIn to run Maester’s own checks in the same run.

About this check

Severity	Medium
Effort to fix	Low
Impact on users	Low
Pillar	SecOps
Category	AI for security
Product	Azure
Feature	Subscriptions
Area	Infrastructure hardening
Licence	Consumption-based: Microsoft Security Copilot
Tenant	Workforce

Product, feature, area and ATT&CK are Maester’s: the assessment does not record them, so Maester keeps them in the pack’s taxonomy.json.

A Microsoft check, part of the Zero Trust Assessment pack. Text from ZeroTrustAssessment 3.1.0, © Microsoft, MIT licence.