Copilot for Security – Deploying a Test Copilot for Security Environment

I previously provided a brief overview of Copilot for Security.  I didn’t dig too far into it because Microsoft provides a great deal of information about the features themselves.  Microsoft doesn’t provide a great deal of information on how to deploy Copilot for Security in a manner that lets you test out the functionality before you deploy it to your organization.  In this post, I plan to provide information for deploying a test Copilot for Security environment that will allow you to test the functionality to determine if the tool will meet your needs.

As always, please be aware of my blog disclaimer

Let’s Talk Cost

First off, I can’t provide you with a free method to test Copilot.  You will have to take up that with your account rep at Microsoft.  And let’s be honest.  Security for Copilot is not cheap.  It also is not licensed-based; it is consumption-based.  Microsoft bases the cost of Copilot for Security on “Security Compute Units” (SCUs).  SCUs are deployed to the environment and are billed by the hour (with one hour being the minimum charge).  Microsoft provides a cost model for the different regions that you can use to estimate the cost to your organization.  You can check it out at that link, but in a nutshell, the cost is $4 per hour per SCU.  For normal enterprise use, Microsoft recommends three (3) SCUs to be deployed to handle the load.  That amounts to about $35,040 per year if you have a single SCU running 24/7, or $105,120 if you run Microsoft’s recommended three SCUs all year.  So, it’s not a cheap feature.  But as we dig more and more into its capabilities, it may come across as worth it to you.

From a test environment perspective, I will initially deploy only a single SCU to my tenant. However, I may have to change this, depending on the amount of testing I ask Copilot to do for me. An SCU is based on the activity you incur against it. If you ask too much, you will need to wait or deploy another SCU to handle the additional requests.

Components of Copilot for Security

There are two main components that make up Copilot for Security.  The first component is simply called Capacity.  This is where Copilot lives or where the context of Copilot exists.  Think of it as a Copilot for Security resource group.  I only use that for comparison, though, as a resource group is still separate, and you will create your Copilot within a resource group.  For this comparison, however, Capacity is where the SCUs live and the work that Copilot performs is done.

The second component is the Environment.  Like Power Platform, the Environment is where the data for Copilot will reside.  You need to set a default environment to tie to your Copilot Capacity.

Creating Capacity

The first step to deploying Copilot for Security is to create Capacity in my environment.  I’m going to do this through the tool’s dashboard at https://securitycopilot.microsoft.com.  You’ll be guided through the necessary steps if you haven’t set anything up yet.  I’ll summarize them here so you know what to expect:

1. As stated above, you will come to a welcome screen. There is no option to change anything, and the only configuration available to you besides changing your tenant directly (in the pancake menu) is to click on Get started

2. You’ll then receive a message that your tenant is being set up.

3. Next you will be prompted to configure the Capacity and provision an SCU.  The following are just recommendations:
   • Azure Subscription: Select the necessary subscription, but it needs to be consumption-based.
   • Resource Group: Select an existing resource group or create a new one. I suggest creating one just for Copilot.
   • Capacity Name: Provide a meaningful name for your capacity.  I gave it one based on my tenant’s name.
   • Prompt evaluation location: this is where you wish to run your prompts to copilot.  If available, select the region that your tenant exists within.
   • “If this location has too much traffic, allow Copilot to evaluate prompts anywhere in the world.“: Check this box if your organization does not have any issues with data crossing national borders.
   • Capacity region: Select the region within the selected evaluation location to run prompts.  Note: At the time of this post, each location only had a single region to select from.  Capacity region is not active until the evaluation location is selected.
   • Security compute units: Select 1 for the test environment (for now).
4. Once the information is entered, place a checkmark in the Terms and Conditions after you have reviewed them and click Continue.

5. You will then get a message that your security capacity is being set up.
6. Because this process was configured from within Copilot for Security’s environment and not within Azure, the environment is created for us and is based on our tenant’s location.  Once the Capacity is configured, the environment is built and deployed.

7. Based on your organization’s policies, select the correct options for sharing information from your Copilot experience.

8. You will then be presented with a message the Copilot will integrate with your M365 environment.  It also advises you how to remove this access if you so choose.

9. The next screen explains who can do what within Copilot.

10. Assuming everything went as expected, you will get a summary page of your configurations.

Clicking finish will take you to the Copilot for Security dashboard

In the next post, I’ll cover provisioning SCUs as necessary to keep your costs down while you test.

Thanks for reading!