updates on overage scu

Author: ceperezb

learn-pr/wwl-sci/security-copilot-describe-core-features/includes/2b-describe-workspaces.md

@@ -6,7 +6,7 @@ You can think of Copilot Workspaces fitting into this analogy. A Copilot workspa
 
 Through the tenant-switching capability in Security Copilot, a user can select in which tenant they'll be working. In our analogy, this is a Copilot user getting access to the house. Once the tenant is selected, a Copilot user can access and work in any workspace (room in the house) to which they have access, within the context of their role permissions in that workspace.
 
-:::image type="content" source="../media/workspace-overview.png" lightbox="../media/workspace-overview.png" alt-text="Illustration of city as an organization, tenant as a house, and workspace as a room in a house.":::
+:::image type="content" source="../media/workspace-overview.png" lightbox="../media/workspace-overview.png" alt-text="Illustration of a house which is like a tenant and a room in the house is like a workspace in Security Copilot.":::
 
 There are many benefits to Copilot workspaces.  
 

learn-pr/wwl-sci/security-copilot-describe-core-features/index.yml

@@ -5,7 +5,7 @@ metadata:
   description: Describe the core features of Microsoft Security Copilot.
   author: wwlpublish
   ms.author: ceperezb
-  ms.date: 11/20/2024
+  ms.date: 04/01/2025
   ms.service: security-copilot
   ai-usage: ai-assisted
   ms.topic: module-standard-task-based

learn-pr/wwl-sci/security-copilot-getting-started/includes/6-describe-how-to-enable-security-copilot.md

@@ -7,7 +7,11 @@ To start using Microsoft Security Copilot, organizations need to take steps to o
 
 ### Provision capacity
 
-Microsoft Security Copilot is sold as a consumptive offering, meaning that customers are billed monthly based on a provisioned capacity that is billed by the hour. The capacity that is provisioned is referred to as a security compute unit (SCU). An SCU is the unit of measure of computing power used to run Copilot in both the standalone and embedded experiences.
+Security Copilot operates on a provisioned capacity and an overage model. Provisioned capacity is billed by the hour while the overage capacity is billed on usage.
+
+You can flexibly provision Security Compute Units (SCUs) to accommodate regular workloads and adjust them anytime without long-term commitments. An SCU is the unit of measure of computing power used to run Copilot in both the standalone and embedded experiences.
+
+To manage unexpected demand spikes, you can allocate an overage amount to ensure that additional SCUs are available when initially provisioned units are depleted during unexpected workload spikes. Overage units are billed on-demand and can be set as unlimited or a maximum amount. This approach enables predictable billing while providing the flexibility to handle both regular and unexpected usage.  See the summary and resources section of this module for links to information on Managing security compute unit usage and Security Copilot pricing.
 
 Before users can start using Copilot, admins need to provision and allocate capacity. To provision capacity:
 

learn-pr/wwl-sci/security-copilot-getting-started/includes/8-summary.md

@@ -18,4 +18,6 @@ Now that you've completed this module, you should be able to:
 - [What is Microsoft Security Copilot?](/security-copilot/microsoft-security-copilot)
 - [Microsoft Security Copilot experiences](/security-copilot/experiences-security-copilot)
 - [Understand authentication in Microsoft Security Copilot](/security-copilot/authentication)
-- [Describe workspaces](/training/modules/security-copilot-describe-core-features/2b-describe-workspaces)
+- [Describe workspaces](/training/modules/security-copilot-describe-core-features/2b-describe-workspaces)
+- [Manage security compute unit usage in Security Copilot](/copilot/security/manage-usage)
+- [Microsoft Security Copilot pricing](https://azure.microsoft.com/pricing/details/microsoft-security-copilot/)