The Value of Microsoft Security Copilot: SCU Billing and Why Agent Design Matters

OSCAR is a KQL-first Security Copilot agent architecture designed to run pre-built KQL skills for automated compliance reporting and repeatable security checks while minimizing Security Compute Unit (SCU) usage; it uses an agent manifest, Azure Logic Apps for scheduling, a custom ComplianceReports_CL Sentinel table for persistence, and workbooks for reporting, and emphasizes patterns like a guaranteed “No Findings” row to provide audit evidence.