CopilotforSecurityControlSCUs

This repository provides to Create/Update SCUs by your shcueduled time and Delete Copilot for Security.

日本語 Readme はこちら

This repository is intended to use Logic Apps to create Microsoft Copilot for Security resources or adjust Security Compute Units (SCUs) based on time slots. It is intended to be used to optimize actual operations or for Proof of Concept (PoC) purposes by adjusting the SCUs based on time slots.

---

Although it is possible to delete Copilot for Security resources based on time slots for PoC purposes, please limit it to testing purposes only, as it may cause various disadvantages. Deleting resources has the following limitations:

• During that time, accessing from the standalone portal and resources that utilize Copilot for Security (such as Defender XDR) will fail due to insufficient capacity.

---

How to Deploy

Details how to deploy logicapps by ARM templates

This Logic Apps will deploy resources using ARM templates. Two templates have been created for Logic Apps

• CfSDeployUpdate.json
  • This template is used to create Copilot for Security and adjust the SCU values.
  • By default, it's set to start at 10:00 JST on weekdays, excluding weekends. Refer to the following for details and how to change it

• CfSDeployDelete.json
  • This template is used to delete Copilot for Security resources.
  • By default, it's set to start at 16:55 JST every day. Refer to the following for details and how to change it.

Parameters

Details parameter in ARM Templates

In ARM templates, you need to set parameters for installation.

Parameter	Description
PlaybookName	The name of the Logic App. You can change it to suit your environment.
DeployCfSTargetResourceGroup	You need to create a target resource group to deploy Microsoft Copilot for Security separately. ※ The Logic App will create/delete CfS in this resource group. ※ Please create the resource group in advance
crossGeoCompute	Initially set as Allowed.
Location	Specifies the target location of Security Copilot. Currently(2025.4) Location can be set from australiaeast, eastus,uksouth,westeurope.
Geo	Specifies the Geo Location for prompt. Currently(2025.4), Prompt location can be set from ANZ,EU,UK,US.
capacityName	The name when deploying Copilot for Security. If you change it, please make sure that the names in both Logic Apps are the same.
numberofSCUs	The number of SCUs to add, update, or delete. ※ A type warning is displayed, but please ignore it as it is by design.
overageAmount	Overage SCU values.
overageState	Initially set as Limited.

After Install ARM Template

Check your logic apps!

After installing the ARM template, please check the following:

• Are there two resources / ARM templates created in the resource group? (Logic App / API connection)
  

• Open the Logic App Designer and check for errors.
  

• Open the Parameters in the top menu of the Logic App and check that the parameter values used in the Logic App are set.

  • DeployCfSSubscriptionId
  • DeployCfSTagetResourceGroup
  • Location
  • Geo
  • capacityName
  • crossGeoCompute
  • numberOfSCUs
  • overageState
  • overageAmount

• This Logic App requires Co-Owner role permission using Managed ID, so please grant the permission.
  • The Logic App needs permission to deploy/delete Copilot for Security in the target resource group.
  • From Identity on the left, set Azure Role Assignment and assign the Co-Owner role.

Tuning

Tuning the deploy / Delete Scheule

In the initial settings,the Logic App starts Copilot for Security every day at 10:00 JST on weekdays except weekends.
If you want to change the schedule, click the "Recurrence" flow and edit the start time.。

The weekend exclusion setting is included in the "Condition" condition later on.

• 0 is Sunday
• 6 is Saturday

Customize Your Environment

Tune your suitable Copilot for Secuirity environment!

• Usecase-1 : SCU Adjustment Model / Weekday 10:00 - 16:55 with 2 SCU Units, 1 SCU Unit on weekends.

  • CfSDeployUpdate.json (Parameter: SCU = 2)
    • Starts at 10:00 / excluding weekend (Sunday/Saturday)
  • CfSDeployUpdate.json (Parameter: SCU = 1)
    • Starts at 16:55

• Usecase-2 : PoC / Trial Copilot for Security / Weekday 10:00 - 16:55 with 1 SCU Unit, excluding Weekends - Low costs

  • CfSDeployUpdate.json
    • Starts at 10:00 / excluding weekend (Sunday/Saturday)
  • CfSDeployUpdate.json
    • Starts at 16:55 as resources deletion