Resolving Copilot for Security capacity limits by increasing provisioned SCUs

SC-200 By islever Editorial Last updated

Short answer

B Increasing the provisioned SCUs restores capacity so Copilot for Security can generate a response.

Question

You have a Microsoft 365 E5 subscription that contains a user named User1. The subscription uses Microsoft 365 Copilot for Security. Copilot for Security uses the Sentinel plugin. User1 is assigned the Copilot Contributor role. During an investigation, User1 submits a prompt and receives a notification that Copilot for Security cannot respond to requests because the security compute unit (SCU) usage is nearing the provisioned capacity limit. You need to ensure that User1 can use Copilot for Security to generate a successful response. What should User1 do?
  1. Wait one hour and resubmit the prompt.
  2. Update the provisioned SCUs. Correct Answer
  3. Run the Microsoft Sentinel Optimization Workbook.
  4. Open a second Copilot for Security session and submit the prompt.

Key Takeaways

Copilot for Security capacity is measured in SCUs; when usage nears the provisioned limit, prompts are rejected, and increasing the provisioned SCUs restores the ability to get responses.

When Copilot for Security cannot respond because security compute unit (SCU) usage is near the provisioned capacity limit, the fix is to increase the provisioned SCUs so there is capacity to generate a response; a Copilot Contributor would need the capacity owner to do this.

Common mistake: Waiting an hour or opening a second session — those do not add capacity and will hit the same limit; only increasing provisioned SCUs resolves the capacity constraint.

Expert Analysis

Why the Answer Is Correct

Microsoft Copilot for Security capacity is provisioned in security compute units (SCUs). When usage approaches the provisioned limit, prompt submissions are blocked with a capacity notification. The resolution is to increase the provisioned SCUs (performed by a capacity owner/contributor or Copilot Owner), which restores the ability to generate responses.

Why the Other Options Are Wrong

Waiting an hour (A) only helps if usage resets, but it does not add capacity and the limit is still hit. Running the Sentinel Optimization Workbook (C) does not change SCU capacity. Opening a second session (D) shares the same capacity pool and will also be blocked.

Community Comment Notes

The community favors B (80 votes). HAjouz and Blasty cite the manage-usage documentation, noting that when usage nears the limit you increase the SCUs or limit prompts. Optimizor_IT correctly adds that a Copilot Contributor cannot manage capacity, so the capacity owner/Owner must perform the increase.

Official Reference

https://learn.microsoft.com/en-us/copilot/security/manage-usage

This link opens the official vendor documentation in a new tab.

Community Votes

B
80%
A
20%

80% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. Blasty 👍 2 Answered B
    When the usage in your organization is nearing the limit, you are notified of it when submitting the prompts. To avoid disruption, you can contact the Azure capacity owner or contributor to increase the security compute units or limit the number of prompts. https://learn.microsoft.com/en-us/copilot/security/manage-usage
  2. HAjouz 👍 2 Answered B
    Increasing the provisioned Security Compute Units (SCUs) will provide the necessary capacity for Copilot for Security to handle the requests without hitting the limit.
  3. Optimizor_IT 👍 1 Answered A
    Updating the provisioned SCUs requires Copilot Owner or Azure capacity owner/contributor permissions. As a Copilot Contributor, User1 cannot update SCUs—Microsoft explicitly states Contributors can’t manage capacity or view the usage dashboard. SCUs are provisioned and billed hourly. If the organization’s capacity is fully consumed within an hour, waiting until the next hour (when usage resets against the provisioned SCUs) might allow new prompts to process, assuming no overage SCUs are configured and the limit resets hourly.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Creating a Microsoft Sentinel bookmark from the Hunting page to support an incident investigation

S-grade

Identifying Affected Entities in Microsoft Defender XDR Incidents

S-grade

Containing a Defender for Identity pass-the-ticket alert by quarantining only the affected device

S-grade

Limiting Microsoft Defender device discovery to specific onboarded devices by creating a device tag first

S-grade

Practice All SC-200 Questions

Access 80 questions with complete answers and detailed explanations.

View Full SC-200 Practice Test →

← Back to SC-200 Study Guide