# Microsoft Security Copilot capacity (Security Compute Units) is provisioned in the tenant
Microsoft Security Copilot is a generative AI assistant that compresses analyst triage time by summarizing incidents, scripts, and entity context across…
Source: https://maester.dev/docs/tests/ZTA.41215
## Overview
Microsoft Security Copilot is a generative AI assistant that compresses analyst triage time by summarizing incidents, scripts, and entity context across Microsoft Defender, Microsoft Sentinel, Microsoft Entra, Microsoft Intune, and Microsoft Purview. The service runs only when the tenant has at least one provisioned Security Compute Unit (SCU) capacity attached to a workspace; without a capacity, neither the standalone portal nor the embedded "Ask Copilot" experiences in Defender XDR are available, and SOC analysts fall back to manual investigation. From a kill-chain perspective, slower analyst workflow is a defender-velocity gap: once a threat actor lands Initial Access, they iterate quickly through Discovery, Credential Access, Lateral Movement, Collection, and Exfiltration; every additional minute of mean-time-to-respond (MTTR) extends the dwell window in which those tactics can complete. Provisioning SCUs is the prerequisite that unlocks AI-assisted triage and is therefore the gating control for every downstream Security Copilot best practice (incident summarization, guided response, script analysis, identity and device review).
## Remediation
- [Onboarding to Security Copilot for non-Microsoft 365 E5 customers](https://learn.microsoft.com/copilot/security/manual-onboarding)
- [Learn about Security Copilot for Microsoft 365 E5 included customers](https://learn.microsoft.com/copilot/security/security-copilot-inclusion)
## Run it
The check runs as part of the whole assessment, with the ZeroTrustAssessment module installed:
```powershell
Install-Module ZeroTrustAssessment -Scope CurrentUser
Connect-Maester
Invoke-Maester -Pack ZTA -SkipBuiltIn
```
Leave out `-SkipBuiltIn` to run Maester's own checks in the same run.
About this check
| | |
| --- | --- |
| Severity | Medium |
| Effort to fix | Low |
| Impact on users | Low |
| Pillar | SecOps |
| Category | AI for security |
| Product | [Azure](/docs/tests/products/azure) |
| Feature | Subscriptions |
| Area | Infrastructure hardening |
| Licence | Consumption-based: Microsoft Security Copilot |
| Tenant | Workforce |
Product, feature, area and ATT&CK are Maester's: the assessment does not record them, so Maester keeps them in the pack's `taxonomy.json`.