Share via

Billing in Data Security Investigations (preview)

Billing in Data Security Investigations (preview) is based solely on the combination of the amount of stored data and the associated computing capacity needed for AI analysis, not a dedicated enterprise plan or license.

This billing combination is based on the storage meter and AI capacity models. The Data Security Investigations (preview) non-AI processing and storage meter allows customers to store data related to an investigation. Security Compute Units (SCUs) are used to measure the computational capacity needed to run the AI analysis within Data Security Investigations (preview).

Storage meter

The storage meter for Data Security Investigations (preview) is based on the pay-as-you-go billing model. Storage is billed on a gigabyte (GB) per month basis for stored data associated with all investigations in your organization.

For example, you have three investigations in your organization that have the following data associated with the items included in the investigation scopes for the current month:

Investigation Items Total data
Data breach 02/12/2025 3,766 200 GB
Potential data theft 03/03/2025 1,982 10 GB
Risky user activity 04/06/2025 287 5 GB

For the current month, you total storage meter would be 215 GB and you'd be billed for that amount at the current per gigabyte rate. When you delete an investigation, the associated data storage amount is no longer billed and the charges are prorated to the number of days the data was stored in the billing cycle.

Some other important considerations for managing storage charges:

  • If you create an investigation, use data storage, and then delete the investigation in a single 24 hour period, you're charged for the storage amount.
  • When you delete an investigation anytime after 00:00 UTC, you're charged for storage for the full day (24 hours).

For more data storage rates and pricing, see Data Security Investigations (preview) storage meter pricing.

AI capacity

SCUs and overage units for Data Security Investigations (preview) are based on the pay-as-you-go billing model. SCUs are required for deep analysis and AI-related processing for your investigations. You can provision SCUs and increase or decrease them at any time. You can configure specific SCU overage units to automatically increase available SCU capacity as needed for AI processing. Billing is calculated on hourly blocks rather than by 60-minute increments and has a minimum of one hour. Any usage within the same hour is billed as a full SCU, regardless of start or end times within that hour. For overage units, you're only charged for any overage units used.

See the Manage usage of security compute units section in this article for guidance on calculating the SCU needs for your organization.

Important

The SCU capacity and overage units for Data Security Investigations (preview) isn't shared with the SCU capacity and overage units used in Microsoft Security Copilot. You must provision separate SCU capacity and overage units for use in each solution. For more information about SCU capacity overage units in Security Copilot, see Manage usage of security compute units in Security Copilot.

Although the provisioned SCU capacity and overage units aren't shared between Data Security Investigations (preview) and Microsoft Security Copilot, the SCU and overage billing rates are the same for SCUs in both solutions. For more information about provisioned SCU capacity and overage unit rates, see Microsoft Security Copilot pricing.

Locations for SCUs and AI processing

SCU processing is conducted using GPU resources in Azure datacenters protected with Azure security and privacy controls. You can choose to select where SCUs are used from any of the following locations:

  • Australia/New Zealand (ANZ)
  • Europe (EU)
  • United Kingdom (UK)
  • United States (US)

You can opt in to having SCUs provisioned and AI analysis processing done anywhere in the world to mitigate potential disruptions in case your primary location experiences high activity. 

Microsoft recommends having SCUs and AI processing done anywhere with available GPU capacity. This enables Data Security Investigations (preview) and Azure to determine the optimal location based on load, latency, and responsiveness.

Configure billing

Before you can use Data Security Investigations (preview) in your organization, you must configure both billing models. Storage meter billing requires a link to an Azure subscription for pay-as-you-go billing. Capacity billing requires dedicated SCU configuration.

Prerequisites

To configure the storage meter and capacity for Data Security Investigations (preview), you must have:

  • An Azure subscription in the same tenant as Microsoft Purview.
  • An Azure resource group in that subscription.
  • Be assigned the Global Administrator role.
  • Be assigned the resource group Owner or Contributor role.

Configure storage meter

The Azure subscription you configure for Data Security Investigations (preview) is used to manage all pay-as-you-go capabilities across Microsoft Purview solutions. If you configured an Azure subscription for other Microsoft Purview solutions previously, you don't have to configure an additional subscription.

To configure storage meter for Data Security Investigations (preview), complete the following steps:

  1. Go to the Microsoft Purview portal and sign in using the credentials for a user account assigned Data Security Investigations (preview) permissions.
  2. Select the Data Security Investigations (preview) solution card.
  3. Select Setup pay-as-you-go-billing for data storage in the Setup tasks section.
  4. On the Setup pay-as-you-go-billing for data storage flyout pane, complete the following fields for the Azure subscription:
    1. Azure subscription: The Azure subscription you want to assign to the storage meter.
    2. Resource group: The resource group in your Azure subscription you want to assign to the storage meter.
  5. Select Enable.

Configure capacity and overage units

The capacity and overage units to use AI services for investigations in your organization is defined by SCUs provisioned. The SCUs and overage units configured in this flyout pane are only used for Data Security Investigations (preview).

To configure capacity for Data Security Investigations (preview), complete the following steps:

  1. Go to the Microsoft Purview portal and sign in using the credentials for a user account assigned Data Security Investigations (preview) permissions.
  2. Select the Data Security Investigations (preview) solution card.
  3. Select Purchase security compute units to use AI in the Setup tasks section.
  4. On the Provision AI capacity flyout pane, complete the following fields:
    1. Azure subscription: The Azure subscription you want to assign to the storage meter.
    2. Resource group: The resource group in your Azure subscription.
    3. AI Analysis data processing location: The primary country/region. Select from the available locations.
    4. (Optional, but recommended): Select the checkbox that you authorize AI to process data at any other available Azure datacenter in other regions.
    5. Provisioned security compute units: Select the number of SCUs you need. You can select 1 to 100 SCUs.
    6. Use overage units when needed: Enable this option to automatically use configured overage units when needed.
    7. Number of overage units: Select No limit to have an unlimited number of SCU overage units available per hour for use as needed by AI processing activities. Select Set maximum limit to define a specific maximum number of SCU overage units per hour for use as needed by AI processing activities. Select 1-999 SCU overage units as needed.
  5. Select the checkbox that you've read, understood, and agree to the Terms and Conditions.
  6. Select Confirm.

Manage usage of security compute units

To manage the usage of SCUs in Data Security Investigations (preview), you need to estimate your likely SCU usage. Some of the variables that you need to consider vary on the processing type:

Process type example Scale units/variables
Prepare data for AI analysis (vectorization) Size of data and extracted text
Vector searches Size of data searched
Categorization Size of data categorized
Examination Size of data examined

To calculate an estimate of the total SCUs needed for your organization, see the following sections during your planning and configuration.

You aren't billed for failed SCU operations but are billed for partial completions. For example, when you successfully vectorize partial data in an investigation scope.

Update provisioned security compute units and overage units

To update the provisioned Security Compute Units (SCUs) and overage units for Data Security Investigations (preview), complete the following steps:

  1. Go to the Azure portal and sign in with a user account that has either owner or contributor role for the Azure subscription associated with the Data Security Investigations (preview) SCU resource.
  2. Navigate to the Subscription where your Data Security Investigations (preview) resource is deployed.
  3. Select the associated Resource group.
  4. Select the DSI SCU capacity resource (for example, DataSecurityInvestigation-GUID).
  5. In the left-nav, select Update > Update Security Compute Units.
  6. Set the number of SCUs per hour needed (1–100).
  7. Verify that Enable Overage Capacity is activated.
  8. Overage Limit: Select All Unlimited Overage Capacity to have an unlimited number of SCU overage units available per hour for use as needed by AI processing activities. Select Set a Maximum Overage Capacity Limit to define a specific maximum number of SCU overage units per hour for use as needed by AI processing activities. Select 1-999 SCU overage units as needed.
  9. Select OK to save the changes.