You have a Microsoft Security Copilot workspace named Workspace1 that is used by Security Operations...

Configure Workspace2 for embedded agent traffic . The distinction in the scenario is between the standalone Security Copilot experience used by SOC analysts and the embedded experience used by security administrators inside Microsoft Defender. Microsoft defines access through the Security Copilot portal as the standalone experience, while Security Copilot functionality accessed from Microsoft Defender and other integrated Microsoft security products is classified as an embedded experience.

Workspace2 already has its own capacity of five Security Compute Units, so the missing configuration is to route the embedded workload to that workspace. Configuring Workspace2 for embedded agent traffic causes usage originating from the administrators ' embedded Defender experience to consume Workspace2 ' s associated capacity, while SOC analysts can continue using Workspace1 for their standalone sessions.

Increasing Workspace2 capacity changes the number of available SCUs but does not determine which workload consumes them. Assigning Workspace1 ' s capacity to Workspace2 is also inappropriate because Security Copilot capacities are associated with workspaces and SCUs cannot be shared between workspaces . Configuring Workspace1 for embedded traffic would route the administrators ' embedded usage to the wrong workspace.

Microsoft ' s SC-500 objectives explicitly include configuring Security Copilot workspaces and managing Security Copilot under Manage and monitor security posture.